Skip to content
OpenAdvisories

Vendor

medplum

3 known vulnerabilities.

Products

medplum 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-44506

    Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

    Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server confi…

    medplum medplum
  • High 7.1
    CVE-2026-53728

    Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

    Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redir…

    medplum medplum @medplum/core npm
  • High 8.5
    CVE-2026-49120

    Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint

    Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attac…

    medplum medplum