# CVE-2026-103019: OpenEMR open redirect in OIDC logout endpoint

Source: https://junglewise.ai/threats/cve-2026-103019-openemr-is-a-free-and-open-source-electronic-health-records-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-103019 · Severity: medium · CVSS 4.3 · Published 2026-11-05

OpenEMR is an electronic health records and medical practice management application. Prior to version 8.3.0, the OIDC logout endpoint fails to validate redirect URIs before redirecting users, allowing an attacker to craft a logout link that sends users to an arbitrary external website while invalidating their session. This enables convincing phishing attacks that appear to originate from the legitimate logout flow.

Technologies: [OpenEMR Project OpenEMR](https://junglewise.ai/threats/technologies/openemr-project-openemr). Vendors: [OpenEMR Project](https://junglewise.ai/threats/vendors/openemr-project).

## Quick answers

**Is CVE-2026-103019 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103019 being exploited in the wild.

**How severe is CVE-2026-103019?** Medium severity, with a CVSS score of 4.3, published 5 November 2026.

**Which products and versions are affected?** OpenEMR Project OpenEMR before 8.3.0.

**Is there a fix for CVE-2026-103019?** Yes: fixed in OpenEMR 8.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103019 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-103019?** Check whether you run OpenEMR Project OpenEMR at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in OpenEMR 8.3.0

## Technical details

The userSessionLogout() function in src/RestControllers/AuthorizationController.php uses decodeToken() to process an id_token_hint without signature verification and redirects to an untrusted post_logout_redirect_uri without validating it against the OAuth client's registered logout_redirect_uris allowlist. An unauthenticated attacker can exploit this via a crafted logout link when the REST API is enabled, bypassing the redirect validation gate that should restrict logout destinations to authorized URIs.

## Affected products

- OpenEMR Project OpenEMR before 8.3.0

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/openemr/openemr/commit/50f789fad45ada625fe8d0faf0c7a9c15ef52aa5](https://github.com/openemr/openemr/commit/50f789fad45ada625fe8d0faf0c7a9c15ef52aa5)
- [https://github.com/openemr/openemr/pull/13133](https://github.com/openemr/openemr/pull/13133)

## Related threats

- [OpenEMR arbitrary local file read in REST document download](https://junglewise.ai/threats/cve-2026-124479-openemr-before-8-4-0-contains-an-arbitrary-local-file-read)
- [OpenEMR account enumeration via timing attack in pre-authentication](https://junglewise.ai/threats/cve-2026-103021-openemr-is-a-free-and-open-source-electronic-health-records-and)