CVE-2026-33303 Overview
CVE-2026-33303 is a stored cross-site scripting (XSS) vulnerability affecting OpenEMR, a widely-used free and open source electronic health records (EHR) and medical practice management application. The vulnerability exists in versions prior to 8.0.0.2 due to unescaped portal_login_username in the portal credential print view.
This flaw enables a patient portal user to set their login username to a malicious XSS payload, which then executes in a clinic staff member's browser when they access the "Create Portal Login" page for that patient. This represents a significant security concern as it allows attacks to cross from the patient session context into the staff/admin session context.
Critical Impact
A malicious patient portal user can execute arbitrary JavaScript in clinic staff browsers, potentially leading to session hijacking, data theft, or privilege escalation within the healthcare application.
Affected Products
- OpenEMR versions prior to 8.0.0.2
- OpenEMR Patient Portal component
- Portal Login Credential Print View functionality
Discovery Timeline
- 2026-03-19 - CVE CVE-2026-33303 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-33303
Vulnerability Analysis
This stored XSS vulnerability (CWE-79) occurs in the patient portal credential print view functionality. The core issue stems from improper output encoding when rendering the portal_login_username field in the templates/patient/portal_login/print.html.twig template file.
When clinic staff navigate to the "Create Portal Login" page for a patient, the application renders the patient's stored username without proper HTML entity encoding. If an attacker has previously stored a malicious JavaScript payload as their username, this code executes within the authenticated staff member's browser session.
The attack vector requires network access and low privileges (patient portal account), but does require user interaction from a staff member viewing the affected page. The scope is changed, meaning the vulnerable component (patient portal) impacts a different security context (staff/admin session).
Root Cause
The root cause is insufficient input sanitization and output encoding in the Twig template responsible for rendering portal login credentials. The portal_login_username variable was directly interpolated into the HTML output without proper escaping, allowing raw HTML and JavaScript to be rendered as executable code rather than display text.
Attack Vector
The attack follows a stored XSS pattern that crosses trust boundaries:
- An attacker creates or modifies a patient portal account
- The attacker sets their login username to contain an XSS payload (e.g., <script>malicious_code</script>)
- When clinic staff access the "Create Portal Login" page for that patient, the payload executes
- The malicious JavaScript runs with the privileges of the staff member's session
- This can lead to session theft, data exfiltration, or further attacks against the healthcare system
// Security patch in templates/patient/portal_login/print.html.twig
* @link http://www.open-emr.org
* @author Stephen Nielson <snielson@discoverandchange.com>
* @author Jerry Padgett <sjpadgett@gmail.com>
+* @author Michael A. Smith <michael@opencoreemr.com>
* @copyright Copyright (c) 2022 Discover and Change, Inc.
* @copyright Copyright (c) 2024 Jerry Padgett <sjpadgett@gmail.com>
+* @copyright Copyright (c) 2026 OpenCoreEMR Inc <https://opencoreemr.com/>
* @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3
#}
<html>
Source: GitHub Commit
Detection Methods for CVE-2026-33303
Indicators of Compromise
- Unusual JavaScript or HTML tags present in patient portal usernames
- Unexpected network requests originating from staff browsers when viewing patient portal pages
- Error logs showing malformed username entries containing script tags or event handlers
- Reports from staff of unexpected browser behavior when accessing patient portal management pages
Detection Strategies
- Implement Content Security Policy (CSP) headers to detect and block inline script execution
- Monitor web application logs for username fields containing HTML special characters (<, >, ", ')
- Deploy web application firewall (WAF) rules to detect XSS patterns in user input fields
- Conduct regular security audits of patient portal data for malicious content
Monitoring Recommendations
- Enable verbose logging for patient portal username modifications
- Set up alerts for CSP violation reports that may indicate XSS exploitation attempts
- Monitor for abnormal session activity following staff access to patient portal management pages
- Review audit logs for patient accounts with suspicious username patterns
How to Mitigate CVE-2026-33303
Immediate Actions Required
- Upgrade OpenEMR to version 8.0.0.2 or later immediately
- Review existing patient portal usernames for potentially malicious content
- Implement Content Security Policy headers to provide defense-in-depth against XSS
- Educate staff about the risks of accessing patient data from untrusted patient accounts
Patch Information
OpenEMR has released version 8.0.0.2 which addresses this vulnerability by implementing proper output encoding for the portal_login_username field. The fix ensures that user-supplied data is properly escaped before being rendered in HTML templates.
For detailed patch information, refer to the GitHub Security Advisory and the commit that addresses this issue.
Workarounds
- If immediate patching is not possible, implement a web application firewall rule to sanitize username inputs
- Review and sanitize existing patient usernames in the database for XSS payloads
- Restrict staff access to the "Create Portal Login" page until the patch can be applied
- Enable strict Content Security Policy headers to mitigate the impact of potential XSS exploitation
# Configuration example - Add CSP headers to Apache configuration
# Add to .htaccess or Apache config for OpenEMR
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
