CVE-2026-25476

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the session expiration check in `library/auth.inc.php` runs only when `skip_timeout_reset` is not present in the request. When `skip_timeout_reset=1` is sent, the entire block that calls `SessionTracker::isSessionExpired()` and forces logout on timeout is skipped. As a result, any request that includes this parameter (e.g. from auto-refresh pages like the Patient Flow Board) never runs the expiration check: expired sessions can continue to access data indefinitely, abandoned workstations stay active, and an attacker with a stolen session cookie can keep sending `skip_timeout_reset=1` to avoid being logged out. Version 8.0.0 fixes the issue.

• CWE-613

• https://github.com/openemr/openemr/commit/02a6a7793402b10356a94626d78e0e1069e92a77Patch
• https://github.com/openemr/openemr/security/advisories/GHSA-gx7q-6fhr-5h33Exploit, Vendor Advisory
• https://github.com/openemr/openemr/security/advisories/GHSA-gx7q-6fhr-5h33Exploit, Vendor Advisory

Published

Feb 25, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25470Improper Control of Generation of Code ('Code Injection') vu…10
• CVE-2026-25471Authentication Bypass Using an Alternate Path or Channel vul…8.1
• CVE-2026-25472Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2026-25473Missing Authorization vulnerability in AA-Team WZone woozone…5.4
• CVE-2026-25474OpenClaw is a personal AI assistant. In versions 2026.1.30 a…7.5
• CVE-2026-25475OpenClaw is a personal AI assistant. Prior to version 2026.1…6.5
• CVE-2026-25477AFFiNE is an open-source, all-in-one workspace and an operat…6.1
• CVE-2026-25478Litestar is an Asynchronous Server Gateway Interface (ASGI) …6.5
• CVE-2026-25479Litestar is an Asynchronous Server Gateway Interface (ASGI) …6.5
• CVE-2026-2548A flaw has been found in WAYOS FBM-220G 24.10.19. This affec…6.3
• CVE-2026-25480Litestar is an Asynchronous Server Gateway Interface (ASGI) …6.5
• CVE-2026-25481Langroid is a framework for building large-language-model-po…9.6