Executive brief
HAPI FHIR is a Java-based library used by healthcare organizations to exchange medical data. A security flaw in its web communication component could cause sensitive information, such as login credentials or private patient data, to be sent to unauthorized third-party servers when a web request is redirected. This could allow an attacker to steal authentication tokens and impersonate legitimate users or access private healthcare records.
Technical details
An information disclosure vulnerability exists in HAPI FHIR's internal HTTP client due to improper header management during redirects. When the client is configured to follow redirects and receives an HTTP 30X response, it retransmits the original request headers—including sensitive authentication or privacy-related headers—to the new host specified in the 'Location' header. This occurs regardless of whether the new host is trusted or resides on a different domain. Attackers could exploit this by inducing a redirect to a malicious server to capture these headers. The issue is addressed in version 6.9.0 by ensuring sensitive headers are not leaked across different origins during redirection.
Affected products
- hapifhir HAPI FHIR (org.hl7.fhir.core) < 6.9.0
- Red Hat Red Hat Fuse 7 7
Timeline
- 2026-03-17: advisory: GitHub advisory published by maintainers
- 2026-03-20: disclosed: CVE published to NVD
- 2026-03-20: patched: Issue patched in version 6.9.0