PT-2026-52565 · Ohif · Ohif

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-12473

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions OHIF (affected versions not specified)

Description The DICOMWebProxy and DICOMJSON data sources, when used with default configurations, fetch an arbitrary URL parameter without proper validation. A global authentication service within the application automatically injects the authenticated user's OIDC Bearer token into these requests, which can lead to the token being sent to an attacker-controlled server.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-12473

Affected Products

Ohif

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-12473 · Security Note
• https://cisa.gov/news-events/ics-advisories/icsma-26-176-02 · Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsma-26-176-02.json · Note
• https://twitter.com/windowsforum/status/2070194373703107004 · Twitter Post