CVE-2025-0896 Orthanc Server Missing Authentication for Critical Function
Orthanc server allows unauthorized access to critical functions when remote access is enabled without basic authentication, exposing medical data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-0896?
CVE-2025-0896 is a critical missing authorization vulnerability in Orthanc server, published on 13 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Orthanc server prior to version 1.5.8 does not enable basic authentication by default when remote access is enabled. This could result in unauthorized access by an attacker.
Weakness: CWE-306
Which versions are affected by CVE-2025-0896?
It affects 1 product.
Products include Orthanc-Server Orthanc.
How do I fix CVE-2025-0896?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-0896 being exploited?
There is no known exploitation of CVE-2025-0896 in the wild and no public exploit code.
Other vulnerabilities in Orthanc server
- CVE-2026-5442 Heap Buffer Overflow in DICOM Image Decoder via VR UL Dimensions
- CVE-2026-5443 Heap Buffer Overflow in DICOM Image Decoder (Palette Color Decode)
- CVE-2026-5445 Out-of-Bounds Read in DicomImageDecoder (DecodeLookupTable)
- CVE-2023-33466 Path traversal in n/a
- CVE-2026-5437 Out-of-Bounds Read in DicomStreamReader
Sources
Also known as DEBIAN-CVE-2025-0896, GHSA-q8wv-5h5r-52rp, UBUNTU-CVE-2025-0896.