CVE-2026-53728
Received Received - Intake

Open Redirect in Medplum Platform

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: GitHub, Inc.

Description
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to that attacker-supplied URL and issues a redirect. Because the external login request state is serialized as raw JSON and later trusted by the callback, an attacker who can tamper with state.redirectUri can cause Medplum to redirect authorization artifacts to an attacker-controlled endpoint. When the registered redirect URI is a bare origin or another prefix that can be extended into a different hostname, this becomes a cross-origin authorization code leak. This issue has been patched in version 5.1.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-04
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-53728

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
medplum medplum to 5.1.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Medplum before version 5.1.6 allows an attacker to manipulate redirect URIs during external identity provider login. The callback endpoint accepts attacker-controlled URLs that only need to start with a registered client redirect URI. After a successful login, Medplum appends login and code values to this URL and redirects, potentially leaking authorization artifacts to an attacker-controlled endpoint if the registered redirect URI can be extended into a different hostname.

Detection Guidance

Check Medplum server version with GET /version or package.json. Monitor HTTP 302 redirects from /auth/external endpoints for unexpected destinations. Inspect server logs for redirect URIs containing attacker-controlled parameters.

Impact Analysis

An attacker could exploit this to steal authorization codes or login tokens, leading to unauthorized access to user accounts or sensitive data. This could result in data breaches, account takeovers, or further exploitation depending on the permissions of the compromised accounts.

Compliance Impact

This vulnerability could lead to unauthorized access to protected health information (PHI) or personal data, violating GDPR and HIPAA requirements for data confidentiality and integrity. Organizations using vulnerable versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Medplum to version 5.1.6 or later. Review and restrict registered redirect URIs to exact matches only. Disable external identity provider callbacks if not required. Monitor for unauthorized redirect attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53728. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart