External risk intelligence

HAPI FHIR Validator Token Stealing Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-34361

The vulnerability resides in a FHIR Validator HTTP service. FHIR services and their associated validation/interoperability endpoints are commonly deployed as network-accessible API services intended to facilitate data exchange between healthcare systems, making them frequently reachable in environments that interface with external or distributed network segments.

Hapifhir Hl7 Fhir Core

before 6.9.4

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the HAPI FHIR Java implementation allows unauthenticated access to an endpoint that can be tricked into revealing authentication tokens for legitimate FHIR servers. This occurs when a malicious actor can register a domain that shares a prefix with a configured server URL, potentially leading to the compromise of sensitive healthcare data exchange credentials. The issue has been addressed in version 6.9.4.

Unauthenticated access could expose server credentials.
Healthcare data exchange services are common targets.
Confirm relevance and assess exposure to credentials.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can compromise the FHIR Validator HTTP service by registering a domain that mimics a legitimate FHIR server's URL. This allows the attacker to intercept and steal sensitive authentication tokens, such as Bearer tokens, Basic authentication credentials, or API keys, which are configured for the actual FHIR server. The vulnerability stems from a flaw in how the service handles URL prefixes when processing requests to the "/loadIG" endpoint.

No authentication required for access.
Triggered by attacker-controlled URL prefix.
Risk of sensitive token theft.

Live Threat

Current exploitation, exposure, and threat context

The HAPI FHIR Validator HTTP service, when unauthenticated and running prior to version 6.9.4, can expose sensitive authentication tokens. This occurs when the "/loadIG" endpoint is tricked into making outbound requests to attacker-controlled URLs, leveraging a flaw in how server URLs are matched to steal credentials like Bearer tokens, Basic authentication, or API keys.

Authentication tokens could be stolen.
Via attacker-controlled URLs and prefix matching.
Enabling unauthorized server access.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for managing healthcare interoperability platforms and Java-based applications are likely owners of this vulnerability. The first practical step is to identify all deployments of HAPI FHIR, confirm their network exposure and business criticality, and then determine the accountable owner for remediation planning.

Platform and application owners should manage the issue.
Verify all FHIR validator HTTP service instances.
Coordinate vendor updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is HAPI FHIR?

HAPI FHIR is a Java-based software library that implements the HL7 FHIR standard. It acts as a framework for healthcare interoperability, allowing different medical systems to exchange and validate clinical data. Because it manages connections between systems, it often handles sensitive authentication credentials required to securely talk to other FHIR-compliant servers.

What is the vulnerability in CVE-2026-34361?

This vulnerability, classified as CWE-552 (Files or Directories Accessible to External Parties), relates to how the software handles external requests. Specifically, a validation service endpoint allows unauthenticated users to trigger outbound requests. Because of a flaw in how the system validates URL prefixes, it can be tricked into sending sensitive authentication tokens—such as API keys or bearer tokens—to a destination controlled by an attacker.

How does an attacker trigger this issue?

An attacker triggers the bug by sending a request to the /loadIG endpoint. The flaw is activated when the attacker provides a domain that prefix-matches a legitimate server URL already configured in the system. Note that this is not triggered by normal, valid API usage; it requires the attacker to actively supply a malicious URL that exploits the specific credential provider logic used by the software to incorrectly route authentication data.

Is my instance affected by this vulnerability?

If you are running HAPI FHIR versions prior to 6.9.4, you are potentially affected. Halo Surface Signal notes that FHIR validator services are often deployed as network-accessible APIs to support data exchange. If your service is reachable from external or distributed network segments to facilitate interoperability, it is more likely to be a target for unauthorized requests directed at the /loadIG endpoint.

What should I do to secure my HAPI FHIR deployment?

The most effective step is to update your HAPI FHIR implementation to version 6.9.4 or later, which contains the fix. Before updating, perform an inventory of all your instances to understand which are running older versions. Prioritize these updates based on whether the validator service is reachable over the network and the sensitivity of the data or credentials stored within your interoperability environment.

References

github.com/hapifhir/org.hl7.fhir.core/security/advisories/GHSA-v…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.