CVSS
8.7
CVSS v4.0
EPSS
0.3%
Exploit Prediction Score
Published
August 7, 2026
Exploitability
EPSS probability 0.3%
Pathling is a set of tools that make it easier to use FHIR and clinical terminology within health data analytics. Prior to version 2.0.0 of Pathling Server, Pathling's bulk-submit operation allows an allowed submitter to supply an explicit `oauthMetadataUrl` parameter that is not validated against `pathling.bulkSubmit.allowableSources`. When present, the bulk-submit OAuth flow trusts metadata and the returned `token_endpoint` from the caller-chosen location, then builds outbound OAuth client authentication directly from the submitter's stored credentials. This is fixed in Pathling Server 2.0.0.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).