CVE-2026-12473 OHIF Viewers DICOM Server-Side request forgery

Two data sources DICOMWebProxy and DICOMJSON shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the...

@ohif/app (>=3.5.0-beta.1, <=3.12.1), @ohif/extension-ultrasound-pleura-bline (>=3.11.0-beta.61, <=3.12.1) +3 more potentially affected by CVE-2026-12473 via @ohif/extension-default (>=3.5.0-beta.1, <=3.12.1)

@ohif/extension-default NPM version =3.5.0-beta.1, =3.5.0-beta.1, =3.11.0-beta.61, =3.11.0-beta.61, =0.0.8, =0.0.15 Source cves: CVE-2026-12473 Source advisory: MEND:CVE-2026-12473...

PT-2026-52565

Name of the Vulnerable Software and Affected Versions OHIF affected versions not specified Description The DICOMWebProxy and DICOMJSON data sources, when used with default configurations, fetch an arbitrary URL parameter without proper validation. A global authentication service within the...

CVE-2026-12473: Server-Side Request Forgery (SSRF)

Two data sources DICOMWebProxy and DICOMJSON shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the...