OpenEMR versions through 8.2.0 have an authentication bypass vulnerability that allows attackers with valid credentials to circumvent multi-factor authentication. This is achieved by exploiting an exposed OAuth2 password grant flow via an unauthenticated client registration endpoint. Attackers can register an OAuth2 client without authentication and use the password grant to obtain an API access token, bypassing normal web interface authentication and MFA controls.