Medplum Vulnerability: Improper Validation of Redirect URI in External Auth Callback (CVE-2026-53728)
A critical vulnerability in Medplum's external auth callback allows an attacker to leak authorization codes by manipulating the redirect URI. This affects users of Medplum's external identity provider flow, potentially leading to full account takeover and exposure of sensitive healthcare data. Immediate action is required to mitigate this vulnerability.