The vulnerability in HAPI FHIR occurs when the system matches request URLs with String.startsWith() without enforcing a trailing slash or host boundary. An attacker can craft a domain that shares the same prefix as a legitimate server URL, such as http://tx.fhir.org.attacker.com. When the client's HTTP redirect follows this forged domain, the server unknowingly dispatches authentication credentials, including Bearer tokens, Basic auth credentials, or API keys. This produces a direct disclosure of sensitive credentials to an adversary, compromising confidentiality and potentially enabling further unauthorized access. The flaw corresponds to the CWE-346 weakness: Unvalidated Redirects and Insufficient Transport Layer Protection.

The affected product is HAPI FHIR Core (org.hl7.fhir.core). All installations using a version prior to 6.9.4 are susceptible, as that release contains the bug in ManagedWebAccessUtils.getServer(). Users employing newer releases, starting with 6.9.4, receive the fixed implementation.

The CVSS base score of 7.4 classifies this as a high risk vulnerability, and while EPSS data is not available, the exposure of authentication tokens suggests the likelihood of exploitation is significant if an attacker can influence the redirect behavior. The vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to poison a redirect or supply a forged URL that matches the server prefix, a scenario that is feasible in environments where external redirect targets are not tightly controlled.