CVE-2026-44506

Medplum, an open-source developer platform for building healthcare applications, contains an information-disclosure flaw (CWE-200) in its OAuth dynamic client registration endpoint (/oauth2/register) in versions 4.1.10 through 5.1.6. An unauthenticated attacker who submits a registration request with a redirect_uri matching that of a preconfigured OAuth client — one defined via the defaultOAuthClients server configuration — receives that client's client_secret in the endpoint's response. With the leaked secret, the attacker can impersonate the preconfigured OAuth client when authenticating to the server, potentially reading limited data and, more significantly, acting as that client to modify or write data, which is reflected in the high integrity component of the 8.2 CVSS score. Only deployments running affected versions that rely on preconfigured OAuth clients are exposed; there is no public proof of concept, the flaw is not in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.2%, indicating no known exploitation yet. The issue is fixed in Medplum 5.1.7.

What to do: Upgrade Medplum to version 5.1.7 or later. If an immediate upgrade is not possible, rotate the client_secret values of all preconfigured OAuth clients defined in the defaultOAuthClients configuration and review authentication logs for unexpected use of those client credentials. Where feasible, restrict network exposure of the /oauth2/register endpoint to trusted clients until patched.