OpenEMR 7.0.1 contains an authentication brute force vulnerability that allows attackers to bypass rate limiting protections by sending repeated login attempts …

OpenEMR 7.0.1 contains a critical authentication brute force vulnerability (CVE-2023-54347) that allows attackers to bypass rate limiting protections. Attackers can send repeated login attempts to the main login endpoint using POST requests with authUser and clearPass parameters. The vulnerability enables systematic testing of username and password combinations without triggering account lockout restrictions. This bypass of security controls makes the application susceptible to credential attacks and unauthorized access attempts.