CVE-2026-47660 aehrc CVE debrief

Who should care

Health data analytics organizations using Pathling Server are advised to assess their exposure and take necessary actions to prevent unauthorized OAuth metadata URL submission. This involves verifying their current version and configuration, upgrading to version 2.0.0 or applying compensating controls, and monitoring for suspicious activity. The vulnerability's impact on operations could lead to unauthorized access or disruption of health data analytics

Why it matters

CVE-2026-47660 is a high-severity vulnerability in Pathling Server that allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated, potentially leading to unauthorized access or disruption of health data analytics services. Health data analytics organizations should verify their exposure, upgrade to version 2.0.0 or apply compensating controls, and monitor for suspicious activity.

• Potential unauthorized access to sensitive health data through manipulated OAuth metadata.
• Possible disruption of health data analytics services due to compromised OAuth authentication.
• Need for verification of current Pathling Server version and configuration to ensure security.
• Priority on upgrading to Pathling Server 2.0.0 or applying compensating controls.

Technical summary

Pathling Server's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This issue is fixed in Pathling Server 2.0.0.

Defensive priority

Health data analytics organizations using Pathling Server should verify their exposure and upgrade to version 2.0.0 or apply compensating controls.

Recommended defensive actions

• Verify exposure by checking current Pathling Server version and configuration.
• Upgrade to Pathling Server 2.0.0 or later.
• Implement compensating controls to restrict OAuth metadata URL submission.
• Monitor for suspicious bulk-submit activity.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability and its fix in Pathling Server 2.0.0. The issue involves an allowed submitter being able to supply an explicit `oauthMetadataUrl` parameter that is not validated, which could lead to unauthorized access or disruption. Health data analytics organizations should verify their exposure, upgrade to version 2.0.0 or apply compensating controls, and monitor for suspicious activity. Evidence is based on CVE and NVD information, with limitations on source-provided details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.