CVE-2026-47660

Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.

• CWE-522
• CWE-918

• https://github.com/aehrc/pathling/security/advisories/GHSA-245h-c573-9vr5

Published

Aug 7, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-47654Use after free in Remote Desktop Client allows an unauthoriz…7.5
• CVE-2026-47655Exposure of sensitive information to an unauthorized actor i…6.5
• CVE-2026-47656Protection mechanism failure in Windows Boot Manager allows …7.9
• CVE-2026-47657HumHub is an Open Source Enterprise Social Network. In versi…7.1
• CVE-2026-47659Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-4766The Easy Image Gallery plugin for WordPress is vulnerable to…6.4
• CVE-2026-47661Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47662Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47663Pathling is a set of tools that make it easier to use FHIR a…8.7
• CVE-2026-47664Pathling is a set of tools that make it easier to use FHIR a…8.6
• CVE-2026-47665Penpot is an open-source design and prototyping platform. In…8.7
• CVE-2026-47666Penpot is an open-source design and prototyping platform. In…7.6