OHIF Viewers DICOM
OHIF Viewers DICOM vulnerable to SSRF, allowing token theft.
A critical Server-Side Request Forgery (SSRF) vulnerability, CVE-2026-12473, has been discovered in OHIF Viewers DICOM versions prior to 3.12.2. This flaw allows attackers to steal authenticated clinician tokens by crafting a malicious link, potentially impacting healthcare systems worldwide. A fix has been released, and users are urged to upgrade.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Open Health Imaging Foundation (OHIF)?
Get an email when a new story names Open Health Imaging Foundation (OHIF), usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical Server-Side Request Forgery (SSRF) vulnerability in OHIF Viewers DICOM (CVE-2026-12473) allows attackers to steal authenticated clinician tokens by tricking users into clicking a malicious link. This is particularly dangerous in healthcare environments where compromised credentials can provide access to sensitive patient imaging data and clinical systems. The vulnerability affects all versions prior to 3.12.2, meaning any unpatched deployment remains at risk. Healthcare organizations are often slower to patch due to uptime and compliance concerns, making this class of vulnerability especially impactful in the medical sector.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
- Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-12473