Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.3

Unvalidated URL Parameter in OHIF Data Sources Exposes Bearer Token

CVE-2026-12473 · published 4 months ago
Summary

The default configuration of OHIF's DICOMWebProxy and DICOMJSON data sources can expose sensitive authentication tokens to unauthorized servers. This can happen when users access malicious websites or data sources. To protect your system, ensure you configure these data sources to validate URL parameters or use a secure setup.

Original advisory text
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically inject...
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.3 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published25 Jun 2026
Updated4 Nov 2026
First seen25 Jun 2026
Sources
CVE-2026-12473 · NVD
Track software like this
Free during beta