CISA 2026-06-25

OHIF Viewers DICOM

CVE-2026-12473

Machine-generated analysis · WAYSCloud LLM

The advisory states that a server-side request forgery (SSRF) vulnerability in OHIF DICOM Web Viewer Framework versions up to v3.12.0 could result in unauthorized exfiltration of authenticated clinicians' OIDC Bearer tokens.

Context

OHIF Viewers DICOM is an open-source web-based medical imaging viewer framework used to access and display DICOM images. The advisory states that two data sources, DICOMWebProxy and DICOMJSON, in the default configuration fetch arbitrary URLs without validation and may include the user's OIDC Bearer token in requests to attacker-controlled servers. This behavior occurs only in custom integration versions where these data sources are enabled. DICOMweb data sources are explicitly noted as not impacted.

Operator considerations

Check: Verify if OHIF DICOM Web Viewer Framework is deployed and determine the version in use.
Patch: Upgrade to version 3.12.2 or later, as the vulnerability is fixed in this release.
Isolate: Remove unused DicomWebProxyDataSource and DicomJSONDataSource configurations from deployment configuration files.
Log: Monitor outbound requests from OHIF instances for connections to unauthorized external domains, particularly those originating from data source modules.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of this vulnerability in a custom integration version could allow an attacker to steal an authenticated clinician's token via a crafted link.

The following versions of OHIF Viewers DICOM are affected:

OHIF DICOM Web Viewer Framework

Read the full advisory on CISA →