CVE-2026-53728

Medplum versions before 5.1.6 validate the redirect URI in the external identity provider callback at GET /auth/external using prefix matching rather than exact matching, and the external login state is serialized as raw JSON and later trusted by the callback. An attacker who can introduce a crafted state value with their own redirectUri into the external sign-in flow (for example via a crafted external login link, consistent with the user-interaction requirement in the CVSS vector) can, after the victim completes a successful external IdP login, make the server append the Medplum login and code values to the attacker-supplied URL and redirect the victim there. When the registered client redirect URI is a bare origin or another prefix that can be extended into a different hostname, this leaks the login value and authorization code cross-origin to an attacker-controlled endpoint, enabling code theft. Only Medplum deployments running versions prior to 5.1.6 that use external identity provider sign-in are affected; instances not using external IdP login are not exposed to this flaw. No public proof-of-concept or confirmed exploitation is known, and EPSS currently estimates about a 0.1% probability of exploitation within 30 days.

What to do: Upgrade Medplum to version 5.1.6 or later, which addresses the redirect URI validation flaw. Deployments using external identity provider login that cannot upgrade immediately should review whether their registered client redirect URIs are bare origins or extendable prefixes (the condition that turns this into a cross-origin code leak), and monitor logs for GET /auth/external redirects carrying login/code parameters to unexpected hosts. Also watch for updates to exploit intelligence, as exploitation status is currently based on an absence of known PoCs rather than positive confirmation.