CVE-2026-33180

HAPI FHIR (Java) prior to 6.9.0 is affected: when the internal HTTP client follows redirects (HTTP 3xx), it may resend the same request headers to the host in the Location header as well as the initial URL. This exposes privacy-sensitive headers (e.g., authentication tokens) to unintended third-p...

HAPI FHIR HTTP authentication leak in redirects

When setting headers in HTTP requests, the internal HTTP client sends headers first to the host in the initial URL but also, if asked to follow redirects and a 30X HTTP response code is returned, to the host mentioned in URL in the Location: response header value. Sending the same set of headers ...