CVE-2026-12473
HIGH
NVD
CVSS Score
8.2
Severity
HIGH
Published
Jun 25, 2026
Vendor
unknown
Description
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.