CVE-2026-24898 is a maximum severity flaw (CVSS 10.0) in OpenEMR, the open source electronic health records system. A MedEx callback endpoint skips authentication and returns the practice's MedEx API tokens to any visitor. OpenEMR 8.0.0 fixes it. Upgrade, and rotate the MedEx credentials your practice used.
What's affected
- Affected: OpenEMR before 8.0.0.
- Fixed in: 8.0.0.
- Precondition: the advisory says the MedEx service must be enabled in the installation.
If your clinic does not use MedEx, the exposed code path is less relevant, but you should still upgrade. The advisory describes a callback endpoint meant for MedEx service calls. It is reachable by anyone who can reach the web server.
How to check if you're exposed
Start with the version. Check the version shown in your installation, or the version file in the install directory. Anything below 8.0.0 is affected.
Then find out whether MedEx is turned on. Look in the practice settings for the MedEx service and check whether the integration is active. A practice that has never enabled MedEx has a smaller exposure.
Then look at the web server. The advisory names the file library/MedEx/MedEx.php. Search your access logs for requests to that path from addresses that are not MedEx or your own network.
grep "library/MedEx/MedEx.php" /var/log/apache2/access.log
Adjust the log path for your server. Repeated POST requests to that file from unknown addresses are worth escalating to your security contact.
What to do now
- Upgrade OpenEMR to 8.0.0 or later. Test on a staging copy first if you have customizations.
- Rotate the MedEx tokens and credentials for your practice, because a disclosed token should be treated as burned. Ask MedEx how to do this for your account.
- Review access logs for the MedEx callback path, and keep them for your records.
- If a token may have been used, treat the situation as a potential exposure of patient data and follow your incident response and breach notification process. Involve your compliance officer.
- Until you can upgrade, restrict access to the callback path at the web server or firewall so only MedEx's addresses can reach it. Check with MedEx for the right source ranges.
- Put OpenEMR behind a VPN or an allow list if it does not need to face the internet.
Why it matters
The advisory quotes the cause. The endpoint sets a flag that turns off authentication, loads the application, and then, whenever a form field called callback_key is present, performs a MedEx login and echoes the full response as JSON. The value of the field is never checked. The response includes the session token, practice data and campaign details, which can include patient identifiers tied to reminder events.
The weakness is CWE-287 (Improper Authentication). It is the simplest form of the class: an endpoint that should have required proof of identity and did not. The CVSS score of 10.0 reflects network reach, no privileges, no interaction and a changed scope, since the token opens a third party service.
Health data raises the stakes. A token for a messaging platform can reveal appointments and contact details, and misuse may trigger legal duties for the practice. The advisory says the consequence could include HIPAA violations. Treat this as a compliance matter as well as a patching task.
What a good response looks like
Practices often run OpenEMR on a small server with one administrator. A short checklist helps: record the version, record which integrations are enabled, keep a staging copy, and subscribe to the project's security advisories. The extra ten minutes at install time makes a patch like this a one hour task instead of a scramble.
If you host OpenEMR for several clinics, check each tenant. A shared code base means every instance shares the flaw until you upgrade it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is CVE-2026-24898 exploited in the wild?
The record does not list it on the CISA Known Exploited Vulnerabilities catalog, and the advisory does not report exploitation. The advisory's impact statement is about what an attacker could do.
Do I need to rotate credentials after upgrading?
Upgrading closes the endpoint but does not invalidate tokens that may already have been read. Ask MedEx how to rotate yours and review your logs.
Sources
Last reviewed: 19 October 2026.
