OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

published 2026-11-05 3 d ago modified 2026-11-06 2 d ago also EUVD-2026-117778

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.

Patch / fix

links 3

github.com/openemr/openemr@50f789f commit
github.com/openemr/openemr#13133 pull request
github.com/openemr/openemr/releases/tag/v8_3_0 release

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

openemr openemr

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-203 Observable Discrepancy
CWE-208 Observable Timing Discrepancy

References

Sources

CVE List CVE-2026-103021
NVD CVE-2026-103021

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary