Skip to content
OpenAdvisories

Vendor

medplum

3 known vulnerabilities.

medplum at a glance

Last 12 months
3
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 2 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 2 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202620
Aug 202600
Jul 202600
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

medplum 3
All Critical High Medium Low Exploited only Public exploit

3 results · Feed

  • High 8.2
    CVE-2026-44506

    Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

    Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server confi…

    medplum medplum
  • High 7.1
    CVE-2026-53728

    Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

    Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redir…

    medplum medplum @medplum/core npm
  • High 8.5
    CVE-2026-49120

    Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint

    Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attac…

    medplum medplum