Executive Summary
A critical vulnerability, CVE-2026-53728, has been discovered in Medplum's external auth callback. The vulnerability allows an attacker to manipulate the redirect URI, potentially leading to a full account takeover and exposure of sensitive healthcare data. This affects users of Medplum's external identity provider flow.
Technical Analysis
The vulnerability is caused by improper validation of redirect URIs in the external auth callback. The `GET /auth/external` endpoint accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. This allows an attacker to redirect authorization artifacts to an attacker-controlled endpoint.
How It Gets Exploited
An attacker can exploit this vulnerability by:
1. Intercepting or crafting an authorization request to Medplum's external identity provider.
2. Modifying the `state.redirectUri` parameter to point to an attacker-controlled endpoint.
3. Using a registered redirect URI as a prefix for the attacker-controlled endpoint.
4. Redeeming the leaked authorization code for a valid access token.
Impact Assessment
The impact of this vulnerability is Critical, with a CVSS score of 9.0 (based on the severity of the vulnerability and its potential impact). The vulnerability affects Medplum users with external identity provider flows configured. An attacker can achieve full account takeover, bypass modern OAuth protections, and potentially access sensitive healthcare data.
Recommended Actions
To mitigate this vulnerability, the following actions are recommended:
1. Update Medplum to require exact string equality for redirect URIs.
2. Bind external auth state to a server-side session or use a HMAC/Signature.
3. Reject prefixable or ambiguous redirect URI shapes during registration.
4. Implement additional security measures, such as monitoring and logging, to detect potential exploitation attempts.
Sources
- GitHub Security Advisories: https://github.com/advisories/GHSA-m44r-7c5h-m6mj