CVE-2023-54347CWE-307

OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass

High · published May 5, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
44.4
In the wild
Unconfirmed
What it is

OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts to the main login endpoint. Attackers can submit POST requests with authUser and clearPass parameters to systematically test username and password combinations without account lockout restrictions.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00537 · 44.4th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-05-05T11:24Z
EPSS history
Timeline
  • 05 MAY 11:24Z
    OpenEMR 7.0.1 Authentication Brute Force Mitigation Bypass
    cvelistv5