Critical SSRF Vulnerability in OHIF DICOM Web Viewer Framework (CVE-2026-12473)
Executive Summary
In June 2026, a critical vulnerability (CVE-2026-12473) was identified in the OHIF DICOM Web Viewer Framework versions up to 3.12.0. This Server-Side Request Forgery (SSRF) flaw allowed attackers to steal authenticated clinicians' OIDC Bearer tokens via crafted links, potentially granting unauthorized access to sensitive patient data. The issue stemmed from two data sources—DICOMWebProxy and DICOMJSON—fetching arbitrary URL parameters without validation, leading to token exposure when requests were sent to attacker-controlled servers. (hipaajournal.com)
The vulnerability was addressed with the release of version 3.12.2 on May 18, 2026. Users are strongly advised to upgrade to this version or later to mitigate the risk. This incident underscores the critical importance of validating external inputs and implementing robust security measures in healthcare applications to protect sensitive information. (machinespirits.com)
Why This Matters Now
The exploitation of CVE-2026-12473 highlights the ongoing risks associated with SSRF vulnerabilities in healthcare applications. As attackers continue to target sensitive medical data, it is imperative for organizations to promptly apply security patches and conduct regular security assessments to prevent unauthorized access and data breaches.
Attack Path Analysis
An attacker exploits a Server-Side Request Forgery (SSRF) vulnerability in OHIF Viewers DICOM to steal an authenticated clinician's OIDC Bearer token. With the stolen token, the attacker gains unauthorized access to sensitive patient data. The attacker then moves laterally within the network to access additional resources. Establishing command and control, the attacker maintains persistent access to the compromised systems. Finally, the attacker exfiltrates sensitive patient data, leading to significant data breaches and potential regulatory penalties.
Kill Chain Progression
Initial Compromise
Description
An attacker exploits a Server-Side Request Forgery (SSRF) vulnerability in OHIF Viewers DICOM to steal an authenticated clinician's OIDC Bearer token.
Related CVEs
CVE-2026-12473
CVSS 8.2A server-side request forgery (SSRF) vulnerability in OHIF DICOM Web Viewer Framework versions up to 3.12.0 allows unauthenticated attackers to redirect authenticated users' OIDC Bearer tokens to attacker-controlled servers via crafted links.
Affected Products:
Open Health Imaging Foundation (OHIF) OHIF DICOM Web Viewer Framework – <=3.12.0
Exploit Status:
no public exploit
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Application Layer Protocol: Web Protocols
Use Alternate Authentication Material: Web Session Cookie
Brute Force: Password Spraying
Valid Accounts
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 – Remote Access
Control ID: AC-17
PCI DSS 4.0 – System and Application Security
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Identity and Access Management
Control ID: 3.1
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Health Care / Life Sciences
OHIF DICOM viewer vulnerability enables authentication token theft via SSRF attacks, compromising patient data access and HIPAA compliance in healthcare systems.
Medical Equipment
Server-side request forgery in medical imaging software allows attackers to steal clinician credentials, potentially disrupting diagnostic workflows and patient care delivery.
Information Technology/IT
Vulnerability exploitation in web-based medical imaging frameworks exposes authentication systems to token theft, requiring immediate patching and security controls implementation.
Computer Software/Engineering
SSRF vulnerability in OHIF viewers demonstrates risks in healthcare software development, necessitating enhanced input validation and secure authentication mechanisms.
Sources
- OHIF Viewers DICOMhttps://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-176-02Verified
- OIDC Credential Theft via Externally Controlled URLhttps://www.machinespirits.com/advisory/0a7f3c/Verified
- High-Severity Vulnerability Identified in OHIF Viewers DICOMhttps://www.hipaajournal.com/high-severity-vulnerability-identified-in-ohif-viewers-dicom/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it would likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-aware policies.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to exploit the SSRF vulnerability may be constrained by limiting unauthorized access to sensitive resources.
Control: Zero Trust Segmentation
Mitigation: The attacker's unauthorized access to sensitive patient data would likely be limited by enforcing strict segmentation policies.
Control: East-West Traffic Security
Mitigation: The attacker's lateral movement within the network could be constrained, limiting access to additional resources.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to establish and maintain command and control channels may be limited, reducing persistent access.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's data exfiltration efforts would likely be constrained, reducing the risk of sensitive data being transmitted out of the network.
The overall impact of the data breach would likely be reduced, minimizing regulatory penalties and preserving patient trust.
Impact at a Glance
Affected Business Functions
- Medical Imaging Viewing
- Patient Data Access
Estimated downtime: N/A
Estimated loss: N/A
Potential exposure of patient health information (PHI) accessible to authenticated users.
Recommended Actions
Key Takeaways & Next Steps
- • Implement input validation and allow-listing to prevent SSRF vulnerabilities.
- • Enforce least privilege and isolation principles to limit access to sensitive resources.
- • Utilize network-level controls to restrict unnecessary egress and access to metadata services.
- • Regularly update and patch systems to address known vulnerabilities.
- • Conduct thorough security assessments and penetration testing to identify and mitigate potential threats.
