CVE-2026-47660
Received Received - Intake

Pathling Server OAuth Metadata Spoofing Vulnerability

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-08
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-47660
EUVD
EUVD-2026-54641

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
aehrc pathling_server to 2.0.0 (exc)
aehrc pathling_server to 1.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Pathling Server allows an authorized submitter to provide a custom OAuth metadata URL that is not checked against allowed sources. Pathling then trusts the metadata and token endpoint from this attacker-controlled URL, leading to the submission of the submitter's stored OAuth credentials to the attacker's endpoint. This enables credential theft and allows the attacker to forge bearer tokens for further authenticated requests.

Detection Guidance

To detect this vulnerability, check if Pathling Server versions prior to 2.0.0 are running. Inspect network logs for outbound OAuth token requests to unexpected endpoints, particularly those matching attacker-controlled `oauthMetadataUrl` values. Review server configurations for misconfigured `pathling.bulkSubmit.allowableSources` settings.

Impact Analysis

An attacker could steal your OAuth client credentials and use them to impersonate you in authenticated requests. This could allow unauthorized access to sensitive data or systems you interact with via Pathling Server. The impact includes potential data breaches, unauthorized modifications, or further lateral movement within connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information (PHI) or personal data, violating GDPR and HIPAA requirements for data confidentiality and integrity. Organizations using Pathling Server may face compliance violations, legal penalties, and reputational damage due to potential data breaches.

Mitigation Strategies

Upgrade Pathling Server to version 2.0.0 or later to address the vulnerability in the bulk-submit operation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47660. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart