OpenEMR OAuth scope canonicalization flaw CVE-2026-126473

OpenEMR before version 8.4.0 contains a critical OAuth scope canonicalization flaw that lets unauthenticated attackers register a colon‑formatted system:Patient.read client and then request an unregistered system/Patient.write scope, granting them full read, modify, and create access to patient records. The flaw is rated CVSS 9.1 (CRITICAL) and was published on 13 Nov 2026. No vendor advisory has yet been issued, and the flaw is not listed in the CISA KEV database. The only publicly available information comes from the NVD record, which lists the affected range and the CVSS score. Organizations using OpenEMR should upgrade to 8.4.0 or later immediately to eliminate this risk. Monitor the OpenEMR GitHub security advisories for a formal vendor patch announcement. NVD record