SSRF in OHIF DICOM Web Viewer Framework (CVE-2026-12473, CVSS 8.2)

The OHIF Viewers DICOM Web Viewer Framework from the Open Health Imaging Foundation carries a server-side request forgery flaw, tracked as CVE-2026-12473 and rated CVSS v3 8.2, per a CISA medical advisory published June 25.

Two data sources shipped in the product's default configuration — DICOMWebProxy and DICOMJSON — are implicated, per the advisory. Successful exploitation in a custom integration version could let an attacker steal an authenticated clinician's token via a crafted link.

The software is deployed worldwide in the healthcare and public health sector, per CISA. Fixed versions, researcher credit and any evidence of exploitation were not carried in the feed and remain unverified here.

Background

The Open Health Imaging Foundation maintains the OHIF Viewer, a widely used open-source, web-based viewer for medical images that runs in a browser without local installation. It is built around DICOM, the decades-old standard for storing and transmitting medical imaging such as CT, MRI and X-ray studies, and DICOM's web-service extensions — and it is embedded in clinical, research and commercial imaging platforms globally, which is why a flaw in its default configuration has reach well beyond any single deployment.

Server-side request forgery flaws allow an attacker to induce a server to issue requests to destinations of the attacker's choosing, which can expose internal services or, as described here, credentials. In a clinical setting, a stolen clinician token is a route to authenticated access to systems handling protected health information.

CISA, the US cybersecurity agency, publishes medical-device and healthcare advisories in coordination with vendors, typically pairing disclosure with mitigation guidance such as minimizing network exposure of clinical systems and isolating them from the open internet.

What comes next

The procedural step for deployers runs through the advisory itself: apply the vendor's remediation or configuration guidance for the implicated data sources and review the exposure of viewer instances, particularly custom integrations of the kind the advisory singles out. Watch the CISA advisory page for updates, including fixed-version details not carried in the material here.