OpenEMR versions 5.0.2 through 7.x.x contain a critical vulnerability where gateway_api_key secret values are rendered to clients in plaintext through at least two code paths. This information disclosure affects the payment processing functionality and could lead to arbitrary money movement or complete account takeover of payment gateway APIs. The vulnerability impacts the front_payment.php and portal_payment.php files. Organizations using OpenEMR for medical practice management should prioritize upgrading to version 8.0.0 where this issue has been resolved.