HAPI FHIR’s internal HTTP client mistakenly forwards authentication or other sensitive headers to any hosts specified in a 30X Location header during redirects. This behavior can reveal credentials or other private data to an attacker who controls the redirect target, potentially allowing impersonation of legitimate client requests. The vulnerability is a classic information‑disclosure flaw identified by CWE‑200 and CWE‑201.

The issue affects the HAPI FHIR library (org.hl7.fhir.core), specifically all versions prior to 6.9.0. Users running these earlier releases are exposed to the risk described.

With a CVSS score of 7.5 and an EPSS score below 1%, the flaw carries a moderate‑high severity, although exploitation likelihood is relatively low due to the reliance on a redirect response. The vulnerability is not listed in CISA’s KEV catalog. An attacker could exploit the weakness by provoking a redirect to a malicious server; because the attack requires only a standard HTTP request that triggers a redirect, it is considered externally exploitable.