OpenEMR versions through 8.2.0 have an improper authentication vulnerability in the OAuth2 dynamic client registration endpoint. This flaw allows unauthenticated attackers to register malicious clients with system-level FHIR scopes by submitting a self-generated RSA keypair. After an administrator approves the client, attackers can use the client_credentials grant with a self-signed JWT assertion to obtain access tokens. These tokens grant read access to all FHIR resources for all patients in the system, potentially exposing sensitive health data.