The vulnerability in OpenEMR up to version 8.2.0 involves improper authentication in the OAuth2 dynamic client registration endpoint. Unauthenticated attackers can register a malicious OAuth2 client by providing a self-generated RSA keypair in the jwks field. Once an administrator approves this client, the attacker can leverage the client_credentials grant type with a self-signed JWT assertion to obtain access tokens. These tokens provide read access to all FHIR resources across all patients, leading to a high-impact data exposure risk. The CVSS 3.1 base score is 8.1, indicating a high severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, and high confidentiality and integrity impact.

Successful exploitation allows unauthenticated attackers to register malicious OAuth2 clients with system-level FHIR scopes. After administrative approval, attackers can obtain access tokens that grant read access to all patient FHIR data in the system. This results in a significant confidentiality breach of sensitive health information. There is no impact on availability reported. The vulnerability poses a high risk to patient data privacy and system integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, organizations should monitor vendor communications for updates. In the meantime, administrators should carefully review and restrict approvals of OAuth2 client registrations, especially scrutinizing any dynamic client registration requests. Limiting administrative approval to trusted personnel and auditing OAuth2 client registrations can help mitigate risk until a fix is available.