CVE-2026-44506highCWE-200

CVE-2026-44506: high-severity vulnerability in medplum

Medplum - Exposure of OAuth client secret via dynamic registration endpoint in self-hosted configurations

Published · Updated

Follow this CVE+ Monitor medplum

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.4%
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect_uri was provided. This issue has been patched in version 5.1.7.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected products
medplum · medplum
Related CVEs — medplum

In the same product, most dangerous first.

CVE-2026-49120MEDIUMMedplum < 5.1.14 SSRF via FHIR Subscription EndpointEPSS 0.2%CVE-2026-53728HIGHMedplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code LeakageEPSS 0.2%