The vulnerability in OpenEMR up to version 8.2.0 involves an authentication bypass where attackers possessing valid user credentials can circumvent multi-factor authentication (MFA). This is possible because the OAuth2 password grant flow is exposed through an unauthenticated client registration endpoint. Attackers can register an OAuth2 client without prior authentication and then use the password grant flow to exchange credentials for an API access token. This token grants access without passing through the standard web interface authentication or MFA enforcement, effectively bypassing these security controls. The CVSS 3.1 score is 8.1 (high severity), reflecting the network attack vector, low attack complexity, required privileges of low, no user interaction, unchanged scope, and high confidentiality and integrity impact.

An attacker with valid credentials can bypass multi-factor authentication protections by exploiting the OAuth2 password grant flow through an unauthenticated client registration endpoint. This allows unauthorized API access tokens to be issued, potentially leading to unauthorized access to sensitive patient data and system functions. The confidentiality and integrity of the system are highly impacted, while availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the OAuth2 client registration endpoint if possible and monitor for unauthorized client registrations. Review and tighten OAuth2 configurations to prevent unauthenticated client registrations and consider disabling the password grant flow if not required. Follow vendor advisories closely for updates and apply patches promptly once released.