BlogPHP2Shell Exploitation: How Secure.com Can Protect YouRead more
← CVE Radar

CVE-2026-103021OpenEMR: Username Enumeration via Pre-Authentication User Settings Loading

OpenEMR is a free and open source electronic health records and medical practice management application. From 6.0.0 until 8.3.0, interface/globals.php uses the unauthenticated authUser login parameter to populate temp_authuserid and load that account's user_settings before authentication succeeds. Existing usernames can therefore cause an additional database query and may apply visible customized settings, while nonexistent usernames skip that behavior. A remote unauthenticated actor can use timing or page differences to enumerate valid accounts for later credential attacks. This issue is fixed in version 8.3.0.

5.3 MEDIUMEPSS 0.34%Not in KEVNVD: Awaiting Analysis

OverviewAffected ProductsReferences
NVD CVE.org

Overview

Severity

ScoreSeverityVersionVector String
5.3MEDIUM3.1GitHub_M (CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Details

CVE ID
CVE-2026-103021
Status
Awaiting Analysis
Assigner (CNA)
GitHub_M
Published
Nov 5, 2026
Last modified
2026-11-06 21:29 UTC
Weaknesses
  • CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-203 · Observable Discrepancy
  • CWE-208 · Observable Timing Discrepancy

Sources

Refreshed hourly from the sources above. Last fetched 2026-11-08 07:51 UTC.