OHIF Viewer SSRF Flaw Exposed Clinician OIDC Tokens via Malicious DICOM Links
Sector Threat Intelligence · 3 sources · Updated 4mo ago · First seen Jun 25, 2026
A high-severity server-side request forgery flaw in OHIF DICOM Web Viewer Framework tracked as CVE-2026-12473 could let attackers steal authenticated clinicians’ OIDC bearer tokens by luring them to open a crafted link. The issue affects versions prior to 3.12.0 and stems from the default DICOMWebProxy and DICOMJSON data sources accepting arbitrary URL parameters without validation, while OHIF’s global authentication service may automatically attach the user’s bearer token to outbound requests sent to attacker-controlled infrastructure. The flaw does not affect DICOMweb data sources.
The vulnerability carries high-severity ratings of CVSS 4.0 8.3 and CVSS 3.1 8.2, and remediation guidance urges organizations to upgrade to the fixed release 3.12.2, disable unnecessary DICOMWebProxy and DICOMJSON data sources, validate all URL parameters, block arbitrary URL fetching, and restrict OIDC token injection to trusted hosts. Public reporting and advisory material indicate the bug is remotely exploitable and particularly relevant to authenticated healthcare imaging deployments where token exposure could enable unauthorized access.
