High-Severity SSRF Vulnerability in OHIF Viewers DICOM Exposes Clinician Tokens A high-severity Server-Side Request Forgery (SSRF) vulnerability (CVE-2026-12473) has been discovered in OHIF (Open Health Imaging Foundation) Viewers DICOM, a widely used medical imaging framework. The flaw, rated 8.2 (CVSS v3.1) and 8.3 (CVSS v4.0), could allow attackers to steal an authenticated clinician’s OIDC Bearer token by tricking them into clicking a malicious link. The vulnerability stems from two default-configured data sources DICOMWebProxy and DICOMJSON which fetch arbitrary URL parameters without proper validation. When exploited, a global authentication service in OHIF injects the clinician’s token into the request, potentially sending it to an attacker-controlled server. Notably, the flaw does not affect DICOMweb data sources. The issue impacts OHIF DICOM Web Viewer Framework versions prior to 3.12.0. The maintainers released a patch in version 3.12.2 on May 18, 2026, addressing the flaw via commits OHIF/Viewers#5985 (master) and OHIF/Viewers#5978 (release/3.12). Organizations using OHIF with authentication or relying on dicomwebproxy/dicomjson in authenticated deployments are urged to review additional mitigation steps outlined in the CISA security advisory.