CVE-2026-25146CWE-200

OpenEMR's payments gateway_api_key secret rendered into client JS code

Critical · published March 3, 2026

CVSS v3.1
9.6
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.0th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-03-03T22:08Z
EPSS history
Timeline
  • 03 MAR 22:08Z
    OpenEMR's payments gateway_api_key secret rendered into client JS code
    cvelistv5