CVE-2026-47660: CWE-522: Insufficiently Protected Credentials in aehrc pathling
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.
AI Analysis
Technical Summary
Pathling Server versions before 2.0.0 have a vulnerability where the bulk-submit operation accepts an explicit oauthMetadataUrl parameter without validating it against the configured allowable sources. This allows an allowed submitter to influence the OAuth metadata and token endpoint used in the OAuth client authentication flow. Because the bulk-submit OAuth flow trusts the caller-chosen metadata URL, it builds outbound OAuth client authentication using the submitter's stored credentials based on potentially untrusted metadata. This insufficient protection of credentials is classified under CWE-522 and CWE-918. The vulnerability is resolved in Pathling Server 2.0.0.
Potential Impact
An attacker who is an allowed submitter can supply a malicious oauthMetadataUrl, causing the system to trust unvalidated OAuth metadata and token endpoints. This can lead to misuse of stored credentials during OAuth client authentication, potentially compromising credential confidentiality and integrity. The CVSS 4.0 score of 8.7 reflects a high severity due to network attack vector, low attack complexity, and no required privileges or user interaction.
Mitigation Recommendations
Upgrade Pathling Server to version 2.0.0 or later, where this vulnerability is fixed by validating the oauthMetadataUrl parameter against allowable sources. Patch status is confirmed by the vendor advisory indicating the fix in version 2.0.0. Until upgrade, restrict allowed submitters and monitor usage of the bulk-submit operation to mitigate risk.
CVE-2026-47660: CWE-522: Insufficiently Protected Credentials in aehrc pathling
Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.
CVSS v4.0
Score 8.7high
Affected software
aehrc
pathling
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Pathling Server versions before 2.0.0 have a vulnerability where the bulk-submit operation accepts an explicit oauthMetadataUrl parameter without validating it against the configured allowable sources. This allows an allowed submitter to influence the OAuth metadata and token endpoint used in the OAuth client authentication flow. Because the bulk-submit OAuth flow trusts the caller-chosen metadata URL, it builds outbound OAuth client authentication using the submitter's stored credentials based on potentially untrusted metadata. This insufficient protection of credentials is classified under CWE-522 and CWE-918. The vulnerability is resolved in Pathling Server 2.0.0.
Potential Impact
An attacker who is an allowed submitter can supply a malicious oauthMetadataUrl, causing the system to trust unvalidated OAuth metadata and token endpoints. This can lead to misuse of stored credentials during OAuth client authentication, potentially compromising credential confidentiality and integrity. The CVSS 4.0 score of 8.7 reflects a high severity due to network attack vector, low attack complexity, and no required privileges or user interaction.
Mitigation Recommendations
Upgrade Pathling Server to version 2.0.0 or later, where this vulnerability is fixed by validating the oauthMetadataUrl parameter against allowable sources. Patch status is confirmed by the vendor advisory indicating the fix in version 2.0.0. Until upgrade, restrict allowed submitters and monitor usage of the bulk-submit operation to mitigate risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-19T21:10:38.796Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a764a22bf8831d53929f641
Added to database: 08/07/2026, 21:12:02 UTC
Last enriched: 08/07/2026, 21:26:05 UTC
Last updated: 09/22/2026, 01:52:43 UTC
Views: 76
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.