Medplum up to 5.1.5 External Identity Provider Callback redirect

Summaryinfo

A vulnerability marked as problematic has been reported in Medplum up to 5.1.5. This vulnerability affects unknown code of the component External Identity Provider Callback. Performing a manipulation results in redirect. This vulnerability is reported as CVE-2026-53728. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Medplum up to 5.1.5. This affects an unknown code of the component External Identity Provider Callback. The manipulation with an unknown input leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on integrity. The summary by CVE is:

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to that attacker-supplied URL and issues a redirect. Because the external login request state is serialized as raw JSON and later trusted by the callback, an attacker who can tamper with state.redirectUri can cause Medplum to redirect authorization artifacts to an attacker-controlled endpoint. When the registered redirect URI is a bare origin or another prefix that can be extended into a different hostname, this becomes a cross-origin authorization code leak. This issue has been patched in version 5.1.6.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-53728 since 06/10/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

Upgrading to version 5.1.6 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• Medplum

Version

• 5.1.0
• 5.1.1
• 5.1.2
• 5.1.3
• 5.1.4
• 5.1.5

Website

• Product: https://github.com/medplum/medplum/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion