Blue Goat analysis
Scored with Blue Goat's medical device cybersecurity risk methodology: STRIDE classification and CVSS v4.0 exploitability, with a severity-of-harm readout for your own ISO 14971 hazard analysis.
OHIF is an open-source, web-based medical image viewer framework that many imaging products and SaMD front ends build on. CISA's advisory covers one vulnerability in versions below 3.12.0.
| CVE | What an attacker can do | STRIDE | CVSS v4.0 Exploitability | Security impact |
|---|---|---|---|---|
| CVE-2026-12473 | Two data sources in the default configuration (DICOMWebProxy and DICOMJSON) fetch an arbitrary URL without validation, and OHIF attaches the logged-in user's OIDC bearer token to that request, sending it to an attacker's server (CWE-918) | Information disclosure, Spoofing | Medium | High |
The published vector is network-reachable with no privileges, but it requires a user to take an action. So Exploitability reads Medium. Confidentiality impact is High on both the viewer and the systems the token unlocks. On Blue Goat's security matrix, that's High as published.
The published vectors describe the software, not your device. If the service is reachable only on a segmented clinical network or behind authentication, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.
| Severity from your hazard analysis | Safety risk at Medium exploitability |
|---|---|
| Negligible | Low |
| Minor or Serious | Medium |
| Critical or Catastrophic | High |
A stolen token lets an attacker act as the user whose session leaked it, with whatever access that user has to images and patient data.
What to check now
- Search your SBOM for OHIF Viewer below 3.12.0.
- Check whether your deployment enables the DICOMWebProxy or DICOMJSON data sources. CISA notes that DICOMweb data sources aren't affected.
- Update to 3.12.2 or later. CISA reports the maintainer released the fix in 3.12.2.
- If you're not affected, record that in a VEX statement with the justification.
- Re-score the threat, and carry any patient-harm result into your ISO 14971 file.
This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.
Related Goat Feed analysis
Other items reviewed by the Blue Goat team.