CVE-2025-68277CWE-451

OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal

High · published February 25, 2026

CVSS v4.0
7.2
EPSS
0%
Percentile
5.6
In the wild
Unconfirmed
What it is

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, when a link is sent via Secure Messaging, clicking the link opens the website within the OpenEMR/Portal site. This behavior could be exploited for phishing. Version 7.0.4 patches the issue.

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:A/VC:H/VI:H/VA:L/SC:H/SI:H/SA:H
EPSS
0.00167 · 5.6th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2026-02-25T01:13Z
EPSS history
Timeline
  • 25 FEB 01:13Z
    OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
    cvelistv5