{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/medplum--5.1.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Medplum (\u003c= 5.1.5)"],"_cs_severities":["high"],"_cs_tags":["oauth","account-takeover","cve","webserver"],"_cs_type":"advisory","_cs_vendors":["Medplum"],"content_html":"\u003cp\u003eMedplum versions 5.1.5 and earlier contain a critical vulnerability in the external identity provider callback handler (GET /auth/external). The application performs a prefix-match (startsWith) validation on the redirect URI provided in the OAuth 'state' parameter instead of an exact-match check. An attacker can craft a malicious state object containing a redirect URI that starts with a legitimate, registered URI but resolves to an attacker-controlled origin.\u003c/p\u003e\n\u003cp\u003eWhen the victim completes an external authentication flow, the Medplum server appends the 'login' and 'code' artifacts to the attacker-supplied URI and redirects the victim's browser. By injecting a custom PKCE verifier into the tampered state object, an attacker can redeem the stolen authorization code, leading to complete account takeover. This vulnerability bypasses intended OAuth security boundaries and poses a severe risk to healthcare data environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker identifies a target client with an identity provider configured and a prefix-matchable redirect URI (e.g., \u003ca href=\"http://callback.audit.local\"\u003ehttp://callback.audit.local\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious JSON 'state' object, inserting a forged 'redirectUri' that starts with the registered prefix but points to attacker infrastructure (e.g., \u003ca href=\"http://callback.audit.local.attacker.com\"\u003ehttp://callback.audit.local.attacker.com\u003c/a\u003e).\u003c/li\u003e\n\u003cli\u003eThe attacker injects a known PKCE 'code_challenge' and method into the forged 'state' object.\u003c/li\u003e\n\u003cli\u003eThe attacker URL-encodes the tampered 'state' object for use in an OAuth request.\u003c/li\u003e\n\u003cli\u003eThe victim is coerced or lured into initiating an external login flow using the attacker's tampered 'state' parameter.\u003c/li\u003e\n\u003cli\u003eUpon IdP authentication, the Medplum server triggers the vulnerable 'externalCallbackHandler', which accepts the forged 'redirectUri' due to insecure prefix matching.\u003c/li\u003e\n\u003cli\u003eThe server redirects the victim's browser to the attacker's server, leaking the 'code' and 'login' parameters.\u003c/li\u003e\n\u003cli\u003eThe attacker redeems the stolen 'code' at the Medplum '/oauth2/token' endpoint using their previously injected PKCE verifier to gain an access token and complete account takeover.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full account takeover (ATO) and unauthorized access to Protected Health Information (PHI) within the Medplum platform. The vulnerability bypasses PKCE protections and allows attackers to pivot from an open redirect to cross-origin data theft. Given the sensitivity of the data managed by Medplum, this impact could lead to significant regulatory violations and breach notification requirements under HIPAA.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch all Medplum installations to a version strictly greater than 5.1.5 immediately.\u003c/li\u003e\n\u003cli\u003eDeploy the provided Sigma rule to webserver logs to detect requests to /auth/external containing suspicious redirect URI patterns that deviate from authorized domains.\u003c/li\u003e\n\u003cli\u003eReview OAuth client configurations to ensure registered redirect URIs are as specific as possible and do not allow for hostname extension via prefix matching.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-17T18:47:14Z","date_published":"2026-08-17T18:47:14Z","id":"https://feed.craftedsignal.io/briefs/2026-08-medplum-redirect-leak/","summary":"An improper redirect URI validation vulnerability in Medplum allows attackers to steal authorization codes and perform account takeover by prefix-matching registered callback URIs.","title":"Medplum External Auth Callback Improper Redirect Validation","url":"https://feed.craftedsignal.io/briefs/2026-08-medplum-redirect-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Medplum (\u003c= 5.1.5)","version":"https://jsonfeed.org/version/1.1"}