Loading vulnerability…
OIDC Token-Leaking SSRF in OHIF Viewers
CVE-2026-12473 is a server-side request forgery vulnerability in OHIF DICOM Web Viewer Framework. The default DICOMWebProxy and DICOMJSON data sources fetch arbitrary URL parameters without validation. When OHIF global authentication is enabled, it automatically attaches the authenticated user’s OIDC bearer token to resulting outbound requests, including requests directed to an attacker-controlled server. DICOMweb data sources are not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker can cause an authenticated clinician’s OIDC bearer token to be sent to an attacker-controlled server. Theft of the token can enable unauthorized access to resources protected by the compromised user’s credentials.
If you can’t patch tonight, do this now.
Disable DICOMWebProxy and DICOMJSON where they are not required, particularly in authenticated deployments. Validate and restrict URL parameters accepted by remaining data sources, prevent arbitrary outbound URL fetching, and block automatic OIDC bearer-token injection for untrusted destinations.
Patch, then assume compromise.
Upgrade OHIF to version 3.12.2 or a later vendor-fixed release. Reconfigure deployments so that DICOMWebProxy and DICOMJSON cannot retrieve arbitrary unvalidated URLs, and ensure bearer tokens are attached only to trusted, allowlisted endpoints.
No public exploits tracked yet. Mallory keeps watching.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.