CVE-2026-12473 OHIF Viewers DICOM Server-Side request forgery
Attackers can exploit SSRF in default DICOM data sources to steal authenticated users' OIDC Bearer tokens from the OHIF Viewer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-12473?
CVE-2026-12473 is a high-severity server-side request forgery vulnerability in Open Health Imaging Foundation (OHIF) DICOM Web Viewer Framework, published on 25 Jun 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
Weakness: CWE-918
Which versions are affected by CVE-2026-12473?
How do I fix CVE-2026-12473?
No fix has been published for CVE-2026-12473 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-12473 being exploited?
There is no known exploitation of CVE-2026-12473 in the wild and no public exploit code.
Sources
Also known as GHSA-jfr3-mc8c-wqgx.