Executive brief
Medplum is a developer platform for building healthcare applications. A vulnerability in self-hosted deployments allows unauthenticated attackers to retrieve OAuth client secrets through the dynamic registration endpoint if they know a preconfigured redirect URI. This could enable unauthorized access to OAuth-protected integrations, potentially compromising API access and third-party application authentication.
Technical details
The /oauth2/register endpoint in Medplum 4.1.10–5.1.6 returned the client_secret of preconfigured OAuth clients (defined via defaultOAuthClients server configuration) when a matching redirect_uri was supplied. The vulnerability affects only self-hosted deployments with dynamic client registration enabled and preconfigured clients containing a client_secret. No authentication is required to exploit this; an attacker needs only knowledge of a configured redirect URI to retrieve the corresponding client_id and client_secret. The issue was resolved in version 5.1.7 by removing client_secret values from all /oauth2/register endpoint responses. No public exploitation in the wild has been reported.
Affected products
- Medplum Medplum 4.1.10 through 5.1.6
Timeline
- 2026-06-02: disclosed
- 2026-04-08: patched: Version 5.1.7 released