Vulnerabilities

TI-2026-32440 CVE-2026-44506

Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

MEDIUM 42

Medplum is a developer platform that enables development of healthcare apps.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00352 Published 2026-09-03 Fixed in 5.1.7 CWE-200

TI-2026-38748 CVE-2026-53728 · GHSA-m44r-7c5h-m6mj

Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

HIGH 66

Medplum is a developer platform that enables development of healthcare apps.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00198 Published 2026-09-03 Fixed in 5.1.6 CWE-345

TI-2026-36340 CVE-2026-49120 · GHSA-w852-7r27-32c6

Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint

LOW 27

Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resour…

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00229 Published 2026-06-02 Fixed in 5.1.14 CWE-918

Vulnerabilities

Filters

Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum < 5.1.14 SSRF via FHIR Subscription Endpoint