Security readout for executives and security teams
Plain-English summary
OpenEMR before 8.0.0 can fail to end inactive user sessions when a specific request flag is present. In a healthcare setting, this can leave abandoned workstations or stolen session cookies usable longer than intended, increasing patient-data exposure risk. The vendor advisory states version 8.0.0 fixes the issue.
Executive priority
Prioritize remediation for any production OpenEMR deployment, especially in clinical environments handling patient records. This is not a remote code execution issue, but it weakens a key control for protecting sensitive health information when sessions are abandoned or stolen.
Technical view
CVE-2026-25476 is a CWE-613 insufficient session expiration flaw in OpenEMR. In affected versions, the session expiration check in library/auth.inc.php can be skipped when skip_timeout_reset is present, preventing SessionTracker::isSessionExpired() from forcing logout. Impact is primarily confidentiality; CVSS is 7.5 with network attack vector and high confidentiality impact.
Likely exposure
Organizations running OpenEMR versions earlier than 8.0.0 are affected. Exposure is higher where OpenEMR is reachable over a network, shared clinical workstations are used, or session cookies could be captured through other weaknesses. The sources do not identify specific hosted services, distributions, or downstream packages beyond OpenEMR itself.
Exploitation context
The CVE record reports no CISA KEV listing, and the provided sources do not claim active exploitation. Abuse requires a valid session context or stolen session cookie; the flaw lets session timeout enforcement be bypassed, rather than directly creating a new account or executing code.
Researcher notes
The public description and commit identify the vulnerable session timeout logic and fixed version. Evidence is sufficient for version-based triage. The provided sources do not include proof of exploitation in the wild, detailed environmental prerequisites, or compensating configuration controls.
Mitigation direction
- Upgrade OpenEMR to version 8.0.0 or later.
- Review the OpenEMR GitHub advisory for vendor-specific guidance.
- Force reauthentication after upgrade for active user sessions.
- Review session timeout and workstation lock policies.
- Monitor for unusual long-lived OpenEMR sessions.
Validation and detection
- Inventory all OpenEMR instances and record their versions.
- Confirm affected systems are below version 8.0.0.
- Verify upgraded systems report OpenEMR 8.0.0 or later.
- Review application logs for unusually persistent sessions.
- Check whether shared clinical workstations enforce independent screen locking.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-613: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-25476 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/openemr/openemr/security/advisories/GHSA-gx7q-6fhr-5h33CVE reference · x_refsource_CONFIRM
- https://github.com/openemr/openemr/commit/02a6a7793402b10356a94626d78e0e1069e92a77CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Session Expiration
Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.