{"metadata": {"vulnerability": "CVE-2026-124445", "count": 14, "kinds": {"milestone": 4, "sighting": 4, "kev": 0, "other": 6}, "linked_omitted": 0}, "data": [{"timestamp": "2026-09-13T00:00:00Z", "date_only": false, "value": "2026-09-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124445", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-08T02:14:31.305Z", "date_only": false, "value": "2026-11-08T02:14:31.305Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-124445", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-11-08T13:15:37.304Z", "date_only": false, "value": "2026-11-08T13:15:37.304Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-124445", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-11-08T13:15:37.304Z", "date_only": false, "value": "2026-11-08T13:15:37.304Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-124445", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-11-08T13:15:37.304Z", "date_only": false, "value": "2026-11-08T13:15:37.304Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124445", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-11-08T13:35:16.194Z", "date_only": false, "value": "2026-11-08T13:35:16.194183Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117581081190082022", "record": "CVE-2026-124445", "field": "creation_timestamp", "uuid": "1aeba28e-e955-4779-8cef-3c0df3ae28fd", "content": "CVE-2026-124445 OpenEMR 7.0.1 before 8.4.0 OneTimeAuth Token Replay and PIN Brute Force OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use and max_access_count flags, never revokes consumed service_auth tokens, and checks login_pin without rate limiting or strict comparison. Attackers holding a captured token can replay it or brute-force the PIN to open patient-portal sessions exposing PHI.\nhttps://www.cve.org/CVERecord?id=CVE-2026-124445https://github.com/openemr/openemr/security/advisories/GHSA-xg3m-9pfq-c8r6https://www.vulncheck.com/advisories/openemr-7.0.1-before-8.4.0-onetimeauth-token-replay-and-pin-brute-force#openemr#CVE_2026_124445#bot", "url": "https://infosec.exchange/users/cve/statuses/117581081190082022"}, {"timestamp": "2026-11-08T14:18:11Z", "date_only": false, "value": "2026-11-08T14:18:11Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-9CWC-JCXX-R43V", "record": "GHSA-9CWC-JCXX-R43V", "field": "database_specific.nvd_published_at", "linked_record": true}, {"timestamp": "2026-11-08T14:18:11.487Z", "date_only": false, "value": "2026-11-08T14:18:11.487", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124445", "record": "FKIE_CVE-2026-124445", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-08T14:40:05.220Z", "date_only": false, "value": "2026-11-08T14:40:05.220943Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mzsnd4l3rs2e", "record": "CVE-2026-124445", "field": "creation_timestamp", "uuid": "12e01648-0600-4370-9e33-6120d70eab5a", "content": "CVE-2026-124445\nVersions of OpenEMR from 7.0.1 up to but not including 8.4.0 do not correctly invalidate one\u2011time service tokens and do not limit attempts to guess the login PIN. This lets an attacker who has captured a token\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mzsnd4l3rs2e"}, {"timestamp": "2026-11-08T15:31:26Z", "date_only": false, "value": "2026-11-08T15:31:26Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-9CWC-JCXX-R43V", "record": "GHSA-9CWC-JCXX-R43V", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event", "linked_record": true}, {"timestamp": "2026-11-08T15:31:26Z", "date_only": false, "value": "2026-11-08T15:31:26Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-9CWC-JCXX-R43V", "record": "GHSA-9CWC-JCXX-R43V", "field": "modified", "linked_record": true}, {"timestamp": "2026-11-08T16:07:32.139Z", "date_only": false, "value": "2026-11-08T16:07:32.139852Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mzss7ifzgr2u", "record": "CVE-2026-124445", "field": "creation_timestamp", "uuid": "b8c597a1-d42a-4211-aebe-28fce30720da", "content": "\ud83d\udea8 CVE-2026-124445 \u2014 CVSS 9.3 CRITICAL\n\nOpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-124445\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mzss7ifzgr2u"}, {"timestamp": "2026-11-08T16:40:46.736Z", "date_only": false, "value": "2026-11-08T16:40:46.736153Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzsu2vzejd2e", "record": "CVE-2026-124445", "field": "creation_timestamp", "uuid": "0daeebf1-c7d3-4a8b-b03e-bca04852e5ee", "content": "New critical vulnerability in openemr: CVE-2026-124445, CVSS 9.3. OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the\u2026 No public exploit reported yet. #CVE #vulnerability\n\nthreatroundup.com/cve/cve-2026...", "url": "https://bsky.app/profile/threatroundup.bsky.social/post/3mzsu2vzejd2e"}, {"timestamp": "2026-11-10T21:46:29.570Z", "date_only": false, "value": "2026-11-10T21:46:29.570", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-124445", "record": "FKIE_CVE-2026-124445", "field": "lastModified", "linked_record": true}], "metrics": {"as_of": "2026-11-11T18:43:12.327Z", "anchors": {"origin": {"timestamp": "2026-09-13T00:00:00Z", "date_only": false, "value": "2026-09-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124445", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-09-13T00:00:00Z", "date_only": false, "value": "2026-09-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124445", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 5164992.327375, "hours": 1434.7200909375001, "days": 59.780003789062505, "min_seconds": 5078592.327375, "max_seconds": 5164992.327375, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-13T00:00:00Z", "date_only": false, "value": "2026-09-13T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-124445", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-11T18:43:12.327Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}