---
id: CVE-2026-53728
title: Medplum is a developer platform that enables development of healthcare apps
summary: >-
  Medplum is a developer platform that enables development of healthcare apps.
  Prior to version 5.1.6, the external identity provider callback at GET
  /auth/external accepts attacker-controlled redirect URIs that only need to
  start with a r…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L'
cwe:
  - CWE-345
  - CWE-601
vendor: medplum
product: medplum
affected:
  - medplum < 5.1.6
patched:
  - '@medplum/core 5.1.6'
published: '2026-09-03'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-53728'
references:
  - url: >-
      https://github.com/medplum/medplum/commit/7ae10035ddadde4dba7b18d3156553940465b3a1
    label: security-advisories@github.com
  - url: 'https://github.com/medplum/medplum/pull/8749'
    label: security-advisories@github.com
  - url: 'https://github.com/medplum/medplum/releases/tag/v5.1.6'
    label: security-advisories@github.com
  - url: 'https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj'
    label: security-advisories@github.com
  - url: 'https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-m44r-7c5h-m6mj'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - npm
epss: 0.00138
epssPercentile: 0.03577
aliases:
  - GHSA-m44r-7c5h-m6mj
ecosystem: npm
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-09-09T17:40:46.117469Z'
ingestedAt: '2026-08-17T13:54:47.748Z'
---

## Overview

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to that attacker-supplied URL and issues a redirect. Because the external login request state is serialized as raw JSON and later trusted by the callback, an attacker who can tamper with state.redirectUri can cause Medplum to redirect authorization artifacts to an attacker-controlled endpoint. When the registered redirect URI is a bare origin or another prefix that can be extended into a different hostname, this becomes a cross-origin authorization code leak. This issue has been patched in version 5.1.6.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-53728)

Affected packages:

- `@medplum/core <= 5.1.5`

Patched in:

- `@medplum/core 5.1.6`

Source: https://github.com/advisories/GHSA-m44r-7c5h-m6mj