Summary
Successful exploitation of this vulnerability in a custom integration version could allow an attacker to steal an authenticated clinician’s token via a crafted link.
The following versions of OHIF Viewers DICOM are affected:
- OHIF DICOM Web Viewer Framework <=v3.12.0
| CVSS | Vendor | Equipment | Vulnerabilities |
|---|---|---|---|
| v3 8.2 | Open Health Imaging Foundation (OHIF) | OHIF Viewers DICOM | Server-Side Request Forgery (SSRF) |
Background
- Critical Infrastructure Sectors: Healthcare and Public Health
- Countries/Areas Deployed: Worldwide
- Company Headquarters Location: United States
Vulnerabilities
CVE-2026-12473
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user’s OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
Affected Products
OHIF Viewers DICOM
Open Health Imaging Foundation (OHIF)
Open Health Imaging Foundation (OHIF) OHIF DICOM Web Viewer Framework: <=v3.12.0
known_affected
Remediations
Mitigation
The maintainer has fixed the reported vulnerability and released version 3.12.2 (2026-05-18). The fix is located at OHIF/Viewers#5985 (master), OHIF/Viewers#5978 (release/3.12).
Mitigation
Users are recommended to upgrade to v3.12.2 or later. Operators who need dicomwebproxy or dicomjson in authenticated deployments must additionally configure the new dangerouslyAllowedOriginsForAuthenticatedEnvironments allowlist in app-config.js.
Mitigation
Users running OHIF with authentication should remove ALL unused DicomWebProxyDataSource and DicomJSONDataSource configurations from the configuration file they are deploying with.
Relevant CWE: CWE-918 Server-Side Request Forgery (SSRF)
Metrics
| CVSS Version | Base Score | Base Severity | Vector String |
|---|---|---|---|
| 3.1 | 8.2 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
| 4.0 | 8.3 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N |
Acknowledgments
- Simon Weber and Volker Schönefeld of Machine Spirits UG reported this vulnerability to CISA
Legal Notice and Terms of Use
This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy).
Recommended Practices
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability.
Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
Locate control system networks and remote devices behind firewalls and isolating them from business networks.
When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.
CISA reminds organizations
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
Read the original article: