CVE-2026-44506 in Medplum
Summary
by MITRE • 09/03/2026
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect_uri was provided. This issue has been patched in version 5.1.7.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in Medplum versions ranging from 4.1.10 through 5.1.6 represents a critical failure in the handling of OAuth2 client credentials, specifically affecting the /oauth2/register endpoint. This flaw allows an attacker to retrieve the client_secret for preconfigured OAuth clients that are defined via the defaultOAuthClients server configuration. The exploitation mechanism relies on providing a matching redirect_uri during the registration or token request process. When such a URI is supplied, the system incorrectly exposes sensitive authentication material that should remain confidential and known only to the application developer and the authorization server. This behavior violates fundamental security principles regarding the protection of credentials and undermines the integrity of the OAuth2 flow intended for healthcare applications built on this platform.
From a technical perspective, the root cause lies in improper access control or logic errors within the endpoint implementation that processes registration requests against preconfigured client definitions. Instead of treating these default clients as immutable configurations with securely stored secrets, the system treats them similarly to dynamically registered clients where credentials might be returned upon successful validation of redirect URIs. This conflation of static configuration data with dynamic registration responses leads to the leakage of sensitive information. The vulnerability is particularly severe because it affects preconfigured clients, which are often used for core integrations or trusted third-party applications within healthcare ecosystems. Compromise of these secrets allows an attacker to impersonate legitimate applications, potentially gaining unauthorized access to protected health information (PHI) and other sensitive data governed by regulations such as HIPAA in the United States.
The operational impact of this vulnerability is significant, particularly given Medplum's role as a developer platform for healthcare apps. An adversary who obtains these client secrets can perform actions on behalf of the compromised application, including accessing patient records, modifying medical data, or initiating fraudulent transactions if financial integrations are present. This not only breaches confidentiality but also compromises integrity and availability depending on how the attacker utilizes the stolen credentials. The exposure undermines trust in the platform's security model and could lead to regulatory penalties due to non-compliance with healthcare data protection standards. Furthermore, since these are default configurations, the risk is amplified as they may be widely deployed across multiple instances without individual customization of security parameters.
This vulnerability aligns closely with CWE-200: Exposure of Sensitive Information to an Unauthorized Actor and CWE-359: Exposure of Private Personal Information to an Unauthorized Actor if patient data is involved in subsequent unauthorized access. In terms of the MITRE ATT&CK framework, this behavior facilitates credential theft which supports techniques such as T1078: Valid Accounts or more specifically T1528: Steal Application Access Token when combined with OAuth flows. The exploitation vector corresponds to improper input validation and insecure configuration management, highlighting the need for strict separation between static server configurations and dynamic client registration processes.
To mitigate this vulnerability, organizations running Medplum versions 4.1.10 through 5.1.6 must immediately upgrade to version 5.1.7 or later where the issue has been patched. For environments that cannot be upgraded instantly, administrators should review server configurations to ensure that defaultOAuthClients are not exposed via public-facing endpoints and consider implementing additional access controls on the /oauth2/register endpoint to restrict who can initiate registration requests against preconfigured clients. It is also advisable to rotate any client secrets that may have been potentially exposed during the window of vulnerability. Regular security audits and penetration testing focusing on OAuth implementations should be conducted to identify similar logic flaws in other endpoints or custom configurations within the healthcare application ecosystem.