CVE-2026-53728

Name of the Vulnerable Software and Affected Versions Medplum versions prior to 5.1.6

Description An issue exists in the external identity provider callback at the 'GET /auth/external' endpoint. The system accepts redirect URIs that only need to start with a registered client redirect URI rather than requiring an exact match. Because the external login request state is serialized as raw JSON and trusted by the callback, an attacker can tamper with the state.redirectUri variable to redirect authorization artifacts, specifically the login and code values, to an attacker-controlled endpoint. This occurs within the externalCallbackHandler() function, which utilizes getClientRedirectUri() to perform a partial match check using the startsWith() method. If a registered redirect URI is a bare origin or a prefix that can be extended into a different hostname, it results in a cross-origin authorization code leak, potentially leading to full account takeover and unauthorized access to protected health information.

Recommendations Update to version 5.1.6. Require exact string equality for redirect URIs. Bind external auth state to a server-side session or use a HMAC/Signature. Reject prefixable or ambiguous redirect URI shapes during registration.