An unauthenticated "/loadIG" endpoint in HAPI FHIR allows external callers to trigger outbound HTTP requests to arbitrary URLs, creating a server‑side request forgery condition. A separate startsWith() flaw in the credential provider permits an attacker to register a domain that matches a prefix of a legitimate FHIR server URL, enabling capture of any authentication tokens (Bearer, Basic, API keys) stored for that server. The combination of these flaws permits an attacker to steal sensitive credentials, potentially giving them full control over the affected FHIR instance. This weakness is classified as CWE‑552, reflecting the excessive exposure of sensitive data.

The problem exists in the HAPI FHIR implementation (org.hl7.fhir.core) and affects all versions released before 6.9.4. Any deployment that exposes the FHIR Validator HTTP service with the "/loadIG" endpoint is vulnerable, regardless of the underlying operating system or network configuration.

The CVSS base score of 9.3 classifies the vulnerability as critical, while the EPSS score of less than 1% indicates that widespread exploitation is currently low. The issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector requires network access to the FHIR Validator and does not need any prior authentication; an attacker can craft a request to the vulnerable endpoint and register a malicious domain to siphon credentials. The flaw is highly actionable and carries the potential for significant credential compromise.