Executive brief
HAPI FHIR is a Java-based library used by healthcare organizations to exchange and validate medical data. A security flaw in how the library handles server connections allows sensitive login credentials—such as API keys and passwords—to be sent to malicious websites. This occurs when the software is tricked by a specially crafted web address that looks similar to a trusted healthcare server, potentially allowing an attacker to steal credentials and impersonate legitimate users.
Technical details
The vulnerability exists in `ManagedWebAccessUtils.getServer()` within the `org.hl7.fhir.utilities` module. The component uses `String.startsWith()` to match request URLs against configured server URLs for credential dispatch without verifying host boundaries or trailing slashes. Consequently, if a trusted server is configured as `http://tx.fhir.org`, an attacker-controlled domain like `http://tx.fhir.org.attacker.com` will trigger a prefix match. When the HTTP client follows a redirect to the malicious domain, it automatically attaches Bearer tokens, Basic auth credentials, or API keys to the request. This issue has been patched in version 6.9.4 by implementing proper host boundary validation.
Affected products
- hapifhir org.hl7.fhir.core (org.hl7.fhir.utilities) < 6.9.4
Timeline
- 2026-03-27: advisory: GitHub Security Advisory published by maintainers
- 2026-03-31: disclosed: CVE-2026-34359 published to NVD
- 2026-03-31: patched: Fix released in version 6.9.4