CVE-2026-25146

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

OpenEMR is a free and open source electronic health records and medical practice management application. From 5.0.2 to before 8.0.0, there are (at least) two paths where the gateway_api_key secret value is rendered to the client in plaintext. These secret keys being leaked could result in arbitrary money movement or broad account takeover of payment gateway APIs. This vulnerability is fixed in 8.0.0.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Mar 3, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-251477.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, in `portal/CVE-2026-251486.1Qwik is a performance focused javascript framework. Prior to version 1.19.0, a Cross-Site Scripting vulnerability in Qwik.js' server-side re CVE-2026-251496.1Qwik is a performance focused javascript framework. Prior to version 1.19.0, an Open Redirect vulnerability in Qwik City's default request h CVE-2026-25155.3The Hostinger Reach – AI-Powered Email Marketing for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due t CVE-2026-2515010.0Qwik is a performance focused javascript framework. Prior to version 1.19.0, a prototype pollution vulnerability exists in the formToObj() f CVE-2026-251515.9Qwik is a performance focused javascript framework. Prior to version 1.19.0, Qwik City’s server-side request handler inconsistently interpre CVE-2026-251526.5Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251538.8Backstage is an open framework for building developer portals, and @backstage/plugin-techdocs-node provides common node.js functionalities f CVE-2026-251546.1LocalSend is a free, open-source app that allows users to share files and messages with nearby devices over their local network without need CVE-2026-251557.1Qwik is a performance focused javascript framework. Prior to version 1.12.0, a typo in the regular expression within isContentType causes in CVE-2026-251566.3HotCRP is conference review software. HotCRP versions from October 2025 through January 2026 delivered documents of all types with inline Co CVE-2026-251577.5OpenClaw is a personal AI assistant. Prior to version 2026.1.29, there is an OS command injection vulnerability via the Project Root Path in