THREAT OPS › Threat News › [GHSA] GHSA-m44r-7c5h-m6mj (high) — Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
[GHSA] GHSA-m44r-7c5h-m6mj (high) — Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
GHSA-m44r-7c5h-m6mj Severity: high CVE: CVE-2026-53728
Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage
## Summary
The external identity provider callback at `GET /auth/external` accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external
MITRE ATT&CK techniques
- CredentialsT1589.001
Indicators of compromise
- CVE-2026-53728cve
- http://callback.audit.local`url
- http://callback.audit.local.oastify.com/cb`url
- http://callback.audit.local.oastify.com/cburl
- http://api.audit.local:8103/auth/external?code=url
- http://callback.audit.local.oastify.com/cb?login=url
- http://api.audit.local:8103/oauth2/tokenurl
- https://app.medplum.comurl
- https://app.medplum.com.attacker.comurl
Original source: https://github.com/advisories/GHSA-m44r-7c5h-m6mj