CVE-2026-24847CWE-601

OpenEMR has Open Redirect in Eye Exam Form

Medium · published February 25, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
7.9
In the wild
Unconfirmed
What it is

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the Eye Exam form module allows any authenticated user to be redirected to an arbitrary external URL. This can be exploited for phishing attacks against healthcare providers using OpenEMR. Version 8.0.0 fixes the issue.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00187 · 7.9th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2026-02-25T01:34Z
EPSS history
Timeline
  • 25 FEB 01:34Z
    OpenEMR has Open Redirect in Eye Exam Form
    cvelistv5