CVE-2025-67752 - OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

Back Back to CVE browser

HIGH

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

Published Feb 25, 2026

8.1

HIGH

CVSS 3.1

EPSS 0.24%

Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify: false`), making all external HTTPS connections vulnerable to man-in-the-middle (MITM) attacks. This affects communication with government healthcare APIs and user-configurable external services, potentially exposing Protected Health Information (PHI). Version 7.0.4 fixes the issue.

Affected products

Vendor Openemr Product Openemr Default
n/a
- Version
  < 7.0.4
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Openemr

n/a

Version	Status	Constraints
< 7.0.4	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-295

Improper Certificate Validation

References (2)

https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a
x_refsource_MISCPatch
https://github.com/openemr/openemr/security/advisories/GHSA-2g6h-725p-pqhp
x_refsource_CONFIRMExploitVendor Advisory

Link	Providers	Tags
https://github.com/openemr/openemr/commit/22f8e53e5769a88b7a16cb223bd197d044c84e5a		x_refsource_MISCPatch
https://github.com/openemr/openemr/security/advisories/GHSA-2g6h-725p-pqhp		x_refsource_CONFIRMExploitVendor Advisory