CVE-2026-34361 - Vulnerability Analysis

Overview

HAPI FHIR < 6.9.4 contains an authentication token theft vulnerability caused by an unauthenticated /loadIG endpoint making outbound HTTP requests combined with a flawed URL prefix matching in credential provider, letting attackers steal authentication tokens, exploit requires attacker to control a domain prefix-matching a configured server URL.

Severity & Score

Impact

Attackers can steal authentication tokens, leading to unauthorized access to legitimate FHIR servers and sensitive healthcare data.

Mitigation

Update to version 6.9.4 or later.

References

• https://github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-vr79-8m62-wh98

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner