OpenEMR Authentication Bypass Via Token Replay and PIN Brute Force

OpenEMR versions 7.0.1 through 8.3.x contain a critical authentication flaw in the OneTimeAuth module that fails to enforce token lifecycle controls and PIN protection mechanisms. The vulnerability stems from three compounding weaknesses: service_auth tokens are never revoked after use despite configured enforce_onetime_use flags, max_access_count limits are ignored entirely, and login PINs are validated without rate limiting or strict comparison operators. This creates a perfect storm for attackers who obtain a valid authentication token—whether through network interception, credential stuffing, or other means—allowing them to replay the token indefinitely or systematically brute-force weak PINs to gain persistent access to patient portals. Healthcare organizations using OpenEMR are directly affected, with attackers able to expose protected health information (PHI) at scale, creating HIPAA violation risks and patient safety concerns.

While this CVE does not map to specific MITRE ATT&CK techniques in current frameworks, Casky's Claude-powered skill detection would identify the underlying attack patterns through behavioral analysis of authentication anomalies. Practitioners using Casky would observe findings aligned with Credential Access (T1110 Brute Force, T1187 Forced Authentication) and Lateral Movement patterns, specifically detecting repeated failed login attempts against the PIN endpoint, token reuse across multiple sessions with different timestamps, and access to patient records from anomalous contexts. The platform's 754 mapped security skills would surface indicators such as: abnormal authentication token lifecycle violations, absence of expected token expiration events, successful logins following systematic PIN enumeration sequences, and concurrent portal access using identical service_auth credentials. Extended reasoning across these signals would flag authentication enforcement failures that traditional rule-based detection misses, enabling practitioners to identify compromised tokens and brute-force campaigns before widespread PHI exposure occurs.