KROMSE explanation

iDentalSoft has a serious security flaw (CVE-2026-126091, CVSS 7.5). The official record says: Dental practice sites hosted with iDentalSoft send a JSON response to any user who loads certain pages containing sensitive information, including OAuth credentials, password hashes, and PII. Fixed in iDentalSoft 14.0.3.

No confirmed attacks and no public attack code yet.

Anyone running iDentalSoft older than 14.0.3.

• Update iDentalSoft to 14.0.3 or later.
• Not sure if you use it? KROMSE can check your product for free.