Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication service in OHIF automatically injects the authenticated user's OIDC Bearer token into the resulting requests, sending it to the attacker-controlled server. DICOMweb data sources are not impacted.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-25 | 4 | Disclosure1General1Patch2 |
| 2026-06-26 | 1 | Disclosure1 |
| 2026-06-27 | 1 | Active Exploitation1 |
| 2026-07-03 | 1 | Disclosure1 |
One link can steal the key a doctor uses to open your medical scans. CVE-2026-12473 hits OHIF, the viewer many hospitals run. What broke, and how to shut it: https://nelsonbrilhante.com/record/NB-L065/x #cybersecurity #healthcare #StaySafe 🙏🖖
Post summary
The post announces that CVE-2026-12473 compromises the OHIF medical imaging viewer by allowing unauthorized key theft and links to a source for details on mitigation.
TRC analysis shows attackers exploiting SSRF vulnerability CVE-2026-12473 in OHIF DICOM viewers to steal clinician OIDC tokens and access patient data. Token theft enables lateral movement across healthcare networks. Runtime segmentation helps contain post-compromise activity in medical environments. #CloudSecurity 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/icsma-26-176-02-cve-2026-12473
Post summary
Attackers are actively exploiting the SSRF flaw CVE-2026‑12473 in OHIF DICOM viewers to steal clinician OIDC tokens and access patient data, facilitating lateral movement within healthcare networks.
High CVSS 8.3 CVE-2026-12473 affects OHIF medical imaging components. Healthcare organizations should review exposure: https://nvd.nist.gov/vuln/detail/CVE-2026-12473 via NVD Recent High CVSS #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/IMifBaFqhN
Post summary
The tweet discloses CVE‑2026‑12473 as a high‑severity vulnerability affecting OHIF medical imaging components and prompts healthcare organizations to review exposure on the NVD.
🚨*CVE* CVE-2026-12473 Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication servi… https://www.cve.org/CVERecord?id=CVE-2026-12473 ----- Traducción: CVE-2026-12473 Dos… http://infoflow.cloud`
Post summary
The post announces CVE-2026-12473, describing how two data sources use an unvalidated URL parameter, but it provides no PoC, exploit code, or patch information.
CVE-2026-12473 Two data sources (DICOMWebProxy and DICOMJSON) shipped in the default configuration fetch an arbitrary URL parameter without validation. A global authentication servi… https://www.cve.org/CVERecord?id=CVE-2026-12473
Post summary
The text reports a basic flaw in two default configurations, but lacks evidence of exploitation, fixes, or deeper technical detail.
🚨 Token leaks via a “crafted link” is the security equivalent of leaving your office badge in the parking meter. Patch OHIF v3.12.2 yesterday—OIDC secrets shouldn’t leak just because someone sent a URL. #WindowsForum #Microsoft #CVE #Security https://windowsforum.com/threads/cve-2026-12473-ohif-token-leak-fix-patch-ohif-v3-12-2-and-secure-authenticated-integrations.430580/?utm_source=x&utm_medium=social&utm_campaign=news_node84 https://t.co/ydbE3bfpzS
Post summary
CVE-2026-12473 is a token‑leak vulnerability caused by a crafted link impacting OHIF's OIDC secrets; the issue has been fixed by patching to OHIF v3.12.2.
🪟 CVE-2026-12473 is the most “please click this link” kind of hospital threat: token leaks via custom integrations. Security isn’t just patches—it’s sane defaults and no trust-by-URL. https://windowsforum.com/threads/cve-2026-12473-ohif-viewer-token-leak-via-crafted-links-patch-3-12-2.430544/?utm_source=x&utm_medium=social&utm_campaign=news_node84 #Cve202612473 #OhifMedicalImaging #DicomwebSecurity https://t.co/uuv63BNozt
Post summary
The forum post highlights that CVE-2026-12473 leads to token leaks through crafted links in the OHIF viewer, and notes that patch version 3.12.2 is available to fix the issue.