Executive brief
HAPI FHIR is a Java-based implementation of the HL7 FHIR standard used for healthcare data interoperability. A vulnerability in its validation service allows unauthenticated attackers to trick the system into sending sensitive authentication tokens (such as API keys and passwords) to a server they control. This could lead to the theft of credentials used to access healthcare registries or clinical data repositories, potentially resulting in unauthorized access to patient health records.
Technical details
The FHIR Validator HTTP service exposes an unauthenticated '/loadIG' endpoint that accepts an 'ig' parameter and passes it to IgLoader.loadIg() without validation, leading to Server-Side Request Forgery (SSRF). A secondary flaw exists in ManagedWebAccessUtils.getServer(), which uses a startsWith() comparison to determine if credentials should be attached to an outbound request. An attacker can register a domain that prefix-matches a legitimate configured FHIR server (e.g., 'legit-server.com.attacker.com') to capture Bearer tokens, Basic auth credentials, or API keys. The vulnerability is further amplified by the SimpleHTTPClient manually following redirects and re-evaluating credential attachment on each hop. The issue is fixed in version 6.9.4 by implementing proper URL origin comparison.
Affected products
- hapifhir org.hl7.fhir.validation < 6.9.4
Timeline
- 2026-03-27: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: CVE published to NVD
- 2026-03-31: patched: Fix released in version 6.9.4