CVE-2026-34359 Details

A vulnerability in HAPI FHIR prior to version 6.9.4 allows for the leakage of authentication credentials, including Bearer tokens, Basic auth credentials, and API keys. The issue arises in the 'ManagedWebAccessUtils.getServer()' method, which uses 'String.startsWith()' to match request URLs against configured server URLs for authentication. Due to the lack of a trailing slash or host boundary check, an attacker-controlled domain can match the prefix of a legitimate server URL and intercept credentials when the HTTP client follows a redirect to that domain. This vulnerability affects any deployment that configures server authentication in 'fhir-settings.json' and makes outbound HTTP requests to terminology servers.

Users are advised to update to HAPI FHIR version 6.9.4 or later, and to ensure that FHIR server URLs are configured correctly with trailing slashes. Additionally, consider reintroducing host-equality checks for redirects to prevent credential leakage.