A vulnerability in the HAPI FHIR library allows for the unauthorized exposure of sensitive information during HTTP redirects, posing a significant risk to data privacy.

This vulnerability is an instance of CWE-200, where the internal HTTP client propagates sensitive headers to an unintended host when following HTTP 30X redirects. The flaw is unauthenticated, as the redirection process occurs automatically during standard request execution.

The unintended disclosure of sensitive headers during redirects could lead to the exposure of authentication tokens, session identifiers, or other private data to malicious third party servers. Given the CVSS score of 7.5, this high severity issue threatens the confidentiality of healthcare data handled by the FHIR standard. Organizations may face severe regulatory implications and loss of trust if sensitive clinical information is intercepted by unauthorized actors.

Immediate Action: Update the affected HAPI FHIR libraries to version 6.9.0 or later across all Java projects.

Proactive Monitoring: Review egress traffic logs for unusual outbound HTTP requests to unexpected domains, particularly those triggered by automated services.

Compensating Controls: Implement strict egress filtering at the network level to prevent services from communicating with unauthorized or untrusted external domains.

Public Exploit Available: Unknown.

This vulnerability represents a critical risk to data confidentiality due to the potential for automated credential or data leakage. Security teams should prioritize the update of all HAPI FHIR dependencies to version 6.9.0 immediately. In environments where an update cannot be performed instantly, network level egress controls should be enforced to restrict the library from following redirects to non-essential or untrusted hosts.