CVE-2026-44506: Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the clientsecret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirecturi was provided. This issue has been patched in version 5.1.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Medplumto a version that resolves this vulnerability.Fixed in 5.1.7
Event History
Frequently Asked Questions
Which deployments are affected?
Self-hosted Medplum deployments running versions 4.1.10 through 5.1.6 are affected when they have preconfigured OAuth clients defined through the defaultOAuthClients server configuration.
What does an attacker need to obtain a client secret?
An attacker can use the /oauth2/register endpoint and provide a redirect_uri matching a preconfigured OAuth client. No privileges or user interaction are indicated by the provided severity vector.
How can I determine whether my deployment may have exposed secrets?
Check whether the deployment ran an affected version and used defaultOAuthClients to define preconfigured OAuth clients. Review requests to /oauth2/register for registrations supplying redirect_uri values that match those clients.
What should I do if a vulnerable deployment was used?
Upgrade to Medplum version 5.1.7. Treat secrets for affected preconfigured OAuth clients as potentially disclosed and replace them.