OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts …

OpenEMR version 7.0.1 contains a critical authentication brute force vulnerability (CVE-2023-54347) that allows attackers to bypass rate limiting protections. The vulnerability enables attackers to send unlimited login attempts to the main login endpoint using POST requests with authUser and clearPass parameters. This security flaw allows systematic testing of username and password combinations without triggering account lockout restrictions, making brute force attacks highly effective against OpenEMR installations.