Vulnerability · Published Jun 25, 2026 · Assigned by icscert
CVE-2026-12473OHIF Viewers DICOM Server-Side request forgery
High 8.2
In plain English
A high-severity server-side request forgery in DICOM Web Viewer Framework from Open Health Imaging Foundation (OHIF). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Official description
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Open Health Imaging Foundation (OHIF) | DICOM Web Viewer Framework | 0 – through v3.12.0 |
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N