CVE-2025-67752 - CVE House
Back to Database
Status published High CVE-2025-67752

OpenEMR Has Disabled SSL Certificate Verification in HTTP Client

Vulnerability Description

OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 7.0.4, OpenEMR's HTTP client wrapper (`oeHttp`/`oeHttpRequest`) disables SSL/TLS certificate verification by default (`verify: false`), making all external HTTPS connections vulnerable to man-in-the-middle (MITM) attacks. This affects communication with government healthcare APIs and user-configurable external services, potentially exposing Protected Health Information (PHI). Version 7.0.4 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-67752

Credits & Attribution

No credits recorded in the NVD database.

References

More from openemr

View All →
CVE-2025-69231
OpenEMR has a Stored XSS in GAD-7 Form that Enables Session Hijacking and Privilege Escalation
High 8.7
CVE-2025-68277
OpenEMR allows links sent via Secure Messaging to be opened in OpenEMR and Portal
High 7.2
CVE-2025-67645
OpenEMR Vulnerable to Broken Access Control in Profile Edit Endpoint
High 8.8
CVE-2025-67491
OpenEMR has Stored XSS in ub04 helper
High 8.5
CVE-2025-54373
OpenEMR may expose Contents of Clinical Notes and Care Planto users who do not have Sensitivities=high privilege
High 7.1

Affected Vendor

Affected Software

openemr
Vulnerable Versions:
< 7.0.4

Timeline

Official Publish: February 25th, 2026
Last Modified: February 27th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-295

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact