CVE-2026-12473: OHIF Viewers DICOM Server-Side request forgery

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-25 · updated 2026-10-25
Weakness: CWE-918

Description

Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.

Affected products

Open Health Imaging Foundation (OHIF) DICOM Web Viewer Framework: through v3.12.0

References

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-176-02.json
https://www.cisa.gov/news-events/ics-advisories/icsma-26-176-02

Get alerted when CVE-2026-12473 or the next vulnerability affects your stack