CVE-2026-33303: OpenEMR Stored XSS Vulnerability

CVE-2026-33303 Overview

CVE-2026-33303 is a stored cross-site scripting (XSS) vulnerability affecting OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application. The vulnerability exists in versions prior to 8.0.0.2 due to unescaped portal_login_username in the portal credential print view.

This flaw enables a patient portal user to set their login username to a malicious XSS payload, which then executes in a clinic staff member's browser when they access the "Create Portal Login" page for that patient. This represents a significant security concern as it allows attacks to cross from the patient session context into the staff/admin session context.

Critical Impact
A malicious patient portal user can execute arbitrary JavaScript in clinic staff browsers, potentially leading to session hijacking, data theft, or privilege escalation within the healthcare application.

Affected Products

OpenEMR versions prior to 8.0.0.2
OpenEMR Patient Portal component
Portal Login Credential Print View functionality

Discovery Timeline

2026-03-19 - CVE CVE-2026-33303 published to NVD
2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-33303

Vulnerability Analysis

This stored XSS vulnerability (CWE-79) occurs in the patient portal credential print view functionality. The core issue stems from improper output encoding when rendering the portal_login_username field in the templates/patient/portal_login/print.html.twig template file.

When clinic staff navigate to the "Create Portal Login" page for a patient, the application renders the patient's stored username without proper HTML entity encoding. If an attacker has previously stored a malicious JavaScript payload as their username, this code executes within the authenticated staff member's browser session.

The attack vector requires network access and low privileges (patient portal account), but does require user interaction from a staff member viewing the affected page. The scope is changed, meaning the vulnerable component (patient portal) impacts a different security context (staff/admin session).

Root Cause

The root cause is insufficient input sanitization and output encoding in the Twig template responsible for rendering portal login credentials. The portal_login_username variable was directly interpolated into the HTML output without proper escaping, allowing raw HTML and JavaScript to be rendered as executable code rather than display text.

Attack Vector

The attack follows a stored XSS pattern that crosses trust boundaries:

An attacker creates or modifies a patient portal account
The attacker sets their login username to contain an XSS payload (e.g., <script>malicious_code</script>)
When clinic staff access the "Create Portal Login" page for that patient, the payload executes
The malicious JavaScript runs with the privileges of the staff member's session
This can lead to session theft, data exfiltration, or further attacks against the healthcare system

twig

// Security patch in templates/patient/portal_login/print.html.twig
 * @link      http://www.open-emr.org
 * @author    Stephen Nielson <snielson@discoverandchange.com>
 * @author    Jerry Padgett <sjpadgett@gmail.com>
+* @author    Michael A. Smith <michael@opencoreemr.com>
 * @copyright Copyright (c) 2022 Discover and Change, Inc.
 * @copyright Copyright (c) 2024 Jerry Padgett <sjpadgett@gmail.com>
+* @copyright Copyright (c) 2026 OpenCoreEMR Inc <https://opencoreemr.com/>
 * @license   https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
 #}
 <html>

Source: GitHub Commit

Detection Methods for CVE-2026-33303

Indicators of Compromise

Unusual JavaScript or HTML tags present in patient portal usernames
Unexpected network requests originating from staff browsers when viewing patient portal pages
Error logs showing malformed username entries containing script tags or event handlers
Reports from staff of unexpected browser behavior when accessing patient portal management pages

Detection Strategies

Implement Content Security Policy (CSP) headers to detect and block inline script execution
Monitor web application logs for username fields containing HTML special characters (<, >, ", ')
Deploy web application firewall (WAF) rules to detect XSS patterns in user input fields
Conduct regular security audits of patient portal data for malicious content

Monitoring Recommendations

Enable verbose logging for patient portal username modifications
Set up alerts for CSP violation reports that may indicate XSS exploitation attempts
Monitor for abnormal session activity following staff access to patient portal management pages
Review audit logs for patient accounts with suspicious username patterns

How to Mitigate CVE-2026-33303

Immediate Actions Required

Upgrade OpenEMR to version 8.0.0.2 or later immediately
Review existing patient portal usernames for potentially malicious content
Implement Content Security Policy headers to provide defense-in-depth against XSS
Educate staff about the risks of accessing patient data from untrusted patient accounts

Patch Information

OpenEMR has released version 8.0.0.2 which addresses this vulnerability by implementing proper output encoding for the portal_login_username field. The fix ensures that user-supplied data is properly escaped before being rendered in HTML templates.

For detailed patch information, refer to the GitHub Security Advisory and the commit that addresses this issue.

Workarounds

If immediate patching is not possible, implement a web application firewall rule to sanitize username inputs
Review and sanitize existing patient usernames in the database for XSS payloads
Restrict staff access to the "Create Portal Login" page until the patch can be applied
Enable strict Content Security Policy headers to mitigate the impact of potential XSS exploitation

bash

# Configuration example - Add CSP headers to Apache configuration
# Add to .htaccess or Apache config for OpenEMR
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"