OHIF DICOM CVE-2026-12473 can steal clinician tokens
Version 3.12.2 is the easy part, because authenticated deployments still need config cleanup before a crafted link becomes credential theft.
TL;DR
CISA disclosed CVE-2026-12473, a high-severity SSRF bug in OHIF DICOM Web Viewer Framework versions <=v3.12.0. In authenticated custom integrations, crafted links can send a clinician's OIDC Bearer token to an attacker-controlled server. Healthcare organizations worldwide, including municipal and government health IT shops, should move to v3.12.2, set the new allowlist when using DICOMWebProxy or DICOMJSON, and remove unused configurations. CISA does not say how many public health environments run OHIF.
CISA's advisory is specific and ugly in the way token bugs are specific and ugly. OHIF Viewers DICOM <=v3.12.0 ships two data sources, DICOMWebProxy and DICOMJSON, that fetch an arbitrary URL parameter without validation. In authenticated deployments, OHIF's global authentication service adds the user's OIDC Bearer token to the resulting request. A crafted link can therefore turn the viewer into the delivery mechanism for a clinician credential. CISA says no known public exploitation has been reported.
Remediation is configuration work as much as patch work. OHIF fixed the issue in v3.12.2, released May 18, 2026, and CISA tells users to upgrade. Operators that still need dicomwebproxy or dicomjson in authenticated deployments must configure dangerouslyAllowedOriginsForAuthenticatedEnvironments in app-config.js. Teams running OHIF with authentication should also remove unused DicomWebProxyDataSource and DicomJSONDataSource entries from the deployment config. DICOMweb data sources are outside the affected set.
CISA had already pulled DICOM software into ICS medical advisories, including MicroDicom DICOM Viewer bugs in May and June 2025 (May advisory, June advisory) and an Orthanc Osimis DICOM Web Viewer cross-site scripting issue in 2024 (advisory). OHIF changes the practitioner problem. Healthcare application owners and municipal or government health IT teams need an inventory of OHIF versions and authenticated data-source configs before the scanner line turns into a token-theft path.
Published ·Deep Fathom