CVE-2026-25146

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25146
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25146.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25146
Aliases
  • GHSA-2hq8-wc73-jvvq
Published
2026-03-03T22:08:22.564Z
Modified
2026-04-10T05:39:57.256757Z
Severity
  • 9.6 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
Summary
OpenEMR's payments gateway_api_key secret rendered into client JS code
Details

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gatewayapikey secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-200"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25146.json"
}
References

Affected packages

Git / github.com/openemr/openemr

Affected ranges

Type
GIT
Repo
https://github.com/openemr/openemr
Events
Introduced
35a67d11567419866d8aa9de0ae355676eeebede
Fixed
b91b73600327acb46252b9fce7d04467eea126fd

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25146.json"