{"id":"CVE-2021-25923","details":"In OpenEMR, versions 5.0.0 to 6.0.0.1 are vulnerable to weak password requirements as it does not enforce a maximum password length limit. If a malicious user is aware of the first 72 characters of the victim user’s password, he can leverage it to an account takeover.","modified":"2026-07-08T21:26:07.477403Z","published":"2021-06-24T11:15:07.877Z","references":[{"type":"FIX","url":"https://github.com/openemr/openemr/commit/28ca5c008d4a408b60001a67dfd3e0915f9181e0"},{"type":"EVIDENCE","url":"https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25923"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openemr/openemr","events":[{"introduced":"a438d034088620bcc1dd3856a3d5c32d1cb17dcc"},{"last_affected":"ea4c4bd0953defc7b90acc891aa1805db659fb67"},{"fixed":"28ca5c008d4a408b60001a67dfd3e0915f9181e0"}],"database_specific":{"cpe":"cpe:2.3:a:open-emr:openemr:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"5.0.0"},{"last_affected":"6.0.0.1"}],"source":["CPE_RANGE","REFERENCES"]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-25923.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}