Critical SSRF Flaw in OHIF DICOM Viewer Exposes Clinician Tokens

A critical Server-Side Request Forgery (SSRF) vulnerability in OHIF Viewers DICOM (CVE-2026-12473) allows attackers to steal authenticated clinician tokens by tricking users into clicking a malicious link. This is particularly dangerous in healthcare environments where compromised credentials can provide access to sensitive patient imaging data and clinical systems. The vulnerability affects all versions prior to 3.12.2, meaning any unpatched deployment remains at risk. Healthcare organizations are often slower to patch due to uptime and compliance concerns, making this class of vulnerability especially impactful in the medical sector.

Tactical Insight

Immediate Actions

Upgrade all OHIF Viewers DICOM installations to version 3.12.2 or later without delay.
Audit active clinician sessions and revoke any tokens that may have been exposed prior to patching.
Block or restrict external URL resolution on DICOM viewer servers to reduce SSRF attack surface.

Long-term Improvements

Implement a formal patch management policy that prioritizes critical vulnerabilities in healthcare-facing applications.
Enforce short-lived, scoped authentication tokens and adopt token rotation policies to limit the blast radius of credential theft.
Apply network segmentation to isolate DICOM viewers from broader clinical and administrative networks.

Detection Measures

Enable detailed logging of outbound HTTP requests from DICOM viewer servers to detect anomalous SSRF attempts.
Deploy a Web Application Firewall (WAF) with rules targeting SSRF patterns for all healthcare-facing web applications.
Integrate vulnerability scanning tools into CI/CD pipelines to catch SSRF-class flaws before deployment.