Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...