FINDING 40+ VULNERABILITIES IN HEALTHCARE SOFTWARE SERVING MORE THAN 100 MILLION PATIENTS

Summary from the TLDR InfoSec newsletter

An AI-assisted review of OpenEMR produced 42 published security advisories, fixed in version 8.5.0 on 27 October 2026. The issues include three critical findings: local file disclosure through the PDF generator, SQL injection through patient-data field names, and another SQL injection. Other bugs exposed patient records, allowed portal credential replacement, and enabled administrator API impersonation through an impersonation chain that combined SQL injection and file disclosure to forge an OAuth bearer token, bypassing password and MFA checks.