CVE-2026-47660 Details
Description
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.
A vulnerability in Pathling Server's bulk-submit operation prior to version 2.0.0 allows an authorized submitter to inject an unvalidated `oauthMetadataUrl` parameter. This oversight enables the bulk-submit OAuth flow to trust metadata from a user-specified location, including the `token_endpoint`, and use it to build outbound OAuth client authentication with the submitter's stored credentials. As a result, an attacker could potentially exfiltrate OAuth client credentials by directing the token request to an attacker-controlled endpoint, and misuse an issued bearer token in subsequent authenticated requests.
Users can upgrade to Pathling Server version 2.0.0 or later, where this vulnerability has been fixed. In addition, it is recommended to validate the `oauthMetadataUrl` against `pathling.bulkSubmit.allowableSources` to prevent unauthorized redirection of outbound credential usage.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 7, 2026CISA-ADP
Assessed Aug 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/aehrc/pathling/security/advisories/GHSA-245h-c573-9vr5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| au.csiro.pathling | All versions |
CPE
Remediation
| |
| au.csiro.pathling-server | <= 1.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 7, 2026 | CVE Modified | CISA-ADP |
| Aug 7, 2026 | New CVE Received | [email protected] |