CVE-2026-12473 is a high-severity SSRF vulnerability (CWE-918) in the OHIF DICOM Web Viewer Framework. The vulnerability arises because two default data sources, DICOMWebProxy and DICOMJSON, accept arbitrary URL parameters without validation. When these URLs are fetched, the global authentication service automatically includes the authenticated user's OIDC Bearer token in the request headers. This behavior can lead to unauthorized disclosure of authentication tokens to attacker-controlled endpoints. Notably, DICOMweb data sources are not impacted by this issue. There is no vendor advisory or patch information available at this time, and the vulnerability has not been reported exploited in the wild.

An attacker can exploit this SSRF vulnerability to cause the server to send requests to arbitrary URLs, including attacker-controlled servers, with the authenticated user's OIDC Bearer token included. This can lead to unauthorized disclosure of sensitive authentication tokens, potentially enabling further attacks such as impersonation or unauthorized access. The vulnerability does not affect DICOMweb data sources, limiting the scope to the two default data sources mentioned.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of the affected data sources (DICOMWebProxy and DICOMJSON) or implement strict validation on URL parameters to prevent arbitrary URL fetching. Monitoring for unusual outbound requests involving authentication tokens may also help detect exploitation attempts.