CVE-2026-53728

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-44506

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-44506

Medplum , a developer platform for healthcare apps, had a flaw in versions 4.1.10 through 5.1.6 affecting self-hosted configurations . The /oauth2/register endpoint (OAuth dynamic registration) could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients serve...

CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

EUVD-2026-70699

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

CVE-2026-44506 Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

EUVD-2026-70698

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728

Medplum , a healthcare developer platform, is vulnerable to authorization code leakage in its external identity provider callback (GET /auth/external). The root cause is that getClientRedirectUri() accepts any redirect URI that prefix-matches a registered value (startsWith), rather than requiring...

CVE-2026-53728: URL Redirection to Untrusted Site

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

PT-2026-85218

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect uri...

CVE-2026-44506: Exposure of Sensitive Information to an Unauthorized Actor

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi wa...

@availhealth/bot-layer (0.1.4), @fuego-systems/core (>=0.1.8, <=0.2.0) +9 more potentially affected by CVE-2026-53728 via @medplum/core (>=5.0.0, <=5.1.5)

@medplum/core NPM version =5.0.0, =0.1.8, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.10, =5.1.5 Source cves: CVE-2026-53728 Source advisory: OSV:GHSA-M44R-7C5H-M6MJ...

GHSA-M44R-7C5H-M6MJ Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Summary The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to...

PT-2026-76718

Name of the Vulnerable Software and Affected Versions Medplum versions prior to 5.1.6 Description An issue exists in the external identity provider callback at the 'GET /auth/external' endpoint. The system accepts redirect URIs that only need to start with a registered client redirect URI rather...

CVE-2026-49120

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attackers can point subscription endpoints ...