CVE-2026-25146

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.

• CWE-200

• https://github.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/interface/patient_file/front_payment.php#L765Product
• https://github.com/openemr/openemr/blob/6a4e18c5ec73e0c755f6f65b28a9652aded1a58b/portal/portal_payment.php#L537Product
• https://github.com/openemr/openemr/commit/fe6341496dc82d5b4f5a3f35891bb2e2481f3b25Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-2hq8-wc73-jvvqExploit, Vendor Advisory

Published

Mar 3, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25140apko allows users to build and publish OCI container images …7.5
• CVE-2026-25141Orval generates type-safe JS clients (TypeScript) from any v…9.8
• CVE-2026-25142SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10
• CVE-2026-25143melange allows users to build apk packages using declarative…7.8
• CVE-2026-25144Talishar is a fan-made Flesh and Blood project. A Stored XSS…5.3
• CVE-2026-25145melange allows users to build apk packages using declarative…5.5
• CVE-2026-25147OpenEMR is a free and open source electronic health records …7.1
• CVE-2026-25148Qwik is a performance focused javascript framework. Prior to…6.1
• CVE-2026-25149Qwik is a performance focused javascript framework. Prior to…6.1
• CVE-2026-2515The Hostinger Reach – AI-Powered Email Marketing for WordPre…5.3
• CVE-2026-25150Qwik is a performance focused javascript framework. Prior to…10
• CVE-2026-25151Qwik is a performance focused javascript framework. Prior to…5.9