Description
The external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum login and code values to that attacker-supplied URL and issues a redirect.
Recommendation
Update the @medplum/core package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.1.5
- Patched version(s): 5.1.6
References
Could your website be exposed too?
SmartScanner can check your website for Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Saltcorn: Open Redirect in `POST /auth/login` due to incomplete `is_relative_url` validation (backslash bypass) - CVE-2026-42259
- sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, pos - CVE-2026-53606
- Open WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Ex - CVE-2026-45395
- Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites - CVE-2026-114125
You might also like:
See something that needs correcting? Let us knowUpdated August 17, 2026