Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.3.0, userSessionLogout() in src/RestControllers/AuthorizationController.php uses decodeToken() to process an id_token_hint without verifying its signature and, when the referenced trusted session is absent, redirects to the caller-supplied post_logout_redirect_uri before validating it against the client's registered redirect URIs. An unauthenticated attacker can craft a logout link that sends a user to an arbitrary external site and invalidates the user's session, enabling convincing phishing flows from the legitimate logout endpoint. The endpoint is reachable when the OpenEMR REST API is enabled. This issue is fixed in version 8.3.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-11-05T20:17:37.717Z",
  "pubdate": "2026-11-05T20:17:37.717Z",
  "executiveSummary": "OpenEMR versions prior to 8.3.0 are susceptible to an open redirect vulnerability combined with unauthorized session invalidation within the REST API component. The vulnerability resides in the userSessionLogout() function in src/RestControllers/AuthorizationController.php, which fails to cryptographically verify the provided id_token_hint and performs an unsafe redirect before validating the post_logout_redirect_uri against registered client allowlists.\nThis flaw allows an unauthenticated attacker to craft malicious links that terminate a victim's active session while simultaneously redirecting them to an arbitrary external domain. The impact is significant, as it enables high-confidence phishing campaigns leveraging the legitimate application domain to capture user credentials or conduct social engineering. The exploit requires the OpenEMR REST API to be enabled, but does not necessitate prior authentication or specialized privileges, making it a critical threat to user security and session integrity within medical practice management environments.",
  "technicalDetails": "The vulnerability is located in the src/RestControllers/AuthorizationController.php file, specifically within the userSessionLogout() function. The root cause of this flaw is twofold: an improper implementation of OpenID Connect (OIDC) logout specifications and a failure to enforce authorization checks during redirect processing.\nWhen the userSessionLogout() function receives a request, it calls decodeToken() to process an id_token_hint. The application fails to perform cryptographic signature verification on this token, allowing the processing of untrusted input as if it were a legitimate session identifier. Furthermore, when the function cannot resolve the referenced session, it immediately triggers a redirection to the user-supplied post_logout_redirect_uri parameter.\nCrucially, this redirection occurs before any validation is performed against the client's registered redirect URIs. By omitting the necessary checks to ensure that the target URI belongs to an allowlist defined for the specific OAuth2/OIDC client, the application becomes an open redirect vector.\nThe attack flow proceeds as follows: 1) An attacker crafts a malicious URL containing a forged id_token_hint and an attacker-controlled post_logout_redirect_uri. 2) The attacker baits an authenticated user into visiting this URL. 3) The OpenEMR REST API component processes the request and calls userSessionLogout(). 4) Because the signature is not verified, the server accepts the forged token context. 5) The server fails to locate the session corresponding to the forged token. 6) The application proceeds to the error handling branch, which executes a redirection using the attacker-controlled parameter. 7) The user is forcibly logged out of their legitimate session, effectively disrupting their workflow, and is then seamlessly redirected to an external malicious site that may mimic a login page or distribute malware.\nThis exploit is reachable by unauthenticated remote attackers provided that the REST API feature is enabled on the OpenEMR instance. Because the vulnerability is triggered by a simple GET or POST request to the logout endpoint, no complex exploit chain is required. The primary post-exploitation impact includes the successful redirection of users to malicious infrastructure under the guise of an official logout process, which significantly increases the success rate of subsequent phishing attacks against administrative or medical staff accessing sensitive health records."
}