by Kastro
Paper/Archive/CVE-2026-25146

CVE-2026-25146

openemr openemr — OpenEMR's payments gateway_api_key secret rendered into client JS code

EPSS 0.5%public exploitCVSS 9.6
critical.is priorityof 100
47
CVSS 9.6 (CNA)9.6 / 10 × 3028.8Not in CISA KEV+300.0EPSS percentile 42.1.421 × 208.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.

Affected

ProductAffectedFixed inSource
openemr>= 5.0.2, < 8.0.0–CNA

Scores by source

GitHub_M (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/openemr/openemr/security/advisories/GHSA-2hq8-wc73-jvvqrefgithub.com/openemr/openemr/commit/fe6341496dc82d5b4f5a3f35891bb2e2481f3b25refgithub.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/interface/patient_file/front_payment.php#L765refgithub.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/portal/portal_payment.php#L537