Description

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect_uri was provided. This issue has been patched in version 5.1.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-09-03T20:17:21.177Z",
  "pubdate": "2026-09-03T20:17:21.177Z",
  "executiveSummary": "Medplum versions 4.1.10 through 5.1.6 contain an information disclosure vulnerability within the /oauth2/register endpoint.\nThis flaw allows unauthorized access to sensitive client_secret credentials associated with preconfigured OAuth clients defined in the defaultOAuthClients server configuration.\nThe vulnerability occurs when an attacker supplies a matching redirect_uri to the /oauth2/register endpoint, triggering the server to improperly leak the secret in the response.\nThe impact is significant, as the exposure of a client_secret enables an attacker to impersonate the legitimate client application, potentially leading to unauthorized data access or malicious OAuth flow interventions.\nThe attack is remotely exploitable without requiring prior authentication or elevated privileges, provided the attacker can identify or guess a valid redirect_uri associated with a default OAuth client.\nThe risk is classified as high due to the exposure of cryptographic secrets that provide foundational trust for the application's authentication infrastructure.\nThis issue has been addressed in version 5.1.7.",
  "technicalDetails": "The vulnerability resides in the implementation logic of the /oauth2/register endpoint, which serves as a registration interface for OAuth 2.0 clients within the Medplum platform.\nThe root cause of this exposure is an insecure response object construction process where the server-side logic fails to sanitize the output when processing registration requests for existing, pre-provisioned clients.\nWhen a user or attacker interacts with the /oauth2/register endpoint and submits a redirect_uri that matches one defined in the server's 'defaultOAuthClients' configuration, the application incorrectly performs a lookup and includes the associated 'client_secret' in the JSON response payload.\nUnder normal operating conditions, client secrets should be treated as highly sensitive data and never returned to the client-side initiator, especially via an unauthenticated or public-facing endpoint.\nThe attack flow proceeds as follows: First, the attacker identifies the /oauth2/register endpoint on the target Medplum instance. Second, the attacker probes the endpoint by submitting a request containing a redirect_uri string that corresponds to a default OAuth client configured on the server. Third, the application's backend logic processes the request, matches the provided URI against the internal configuration, and erroneously serializes the internal client secret into the response body.\nThis behavior exposes the secret to any actor capable of reaching the endpoint, effectively bypassing the security boundary intended to keep secret credentials protected within the application's environment.\nBecause the 'client_secret' is critical for the integrity of OAuth 2.0 authorization code flows, its compromise allows an attacker to manipulate token requests, spoof client identity during authentication handshakes, and potentially intercept or access sensitive healthcare data protected by the authorization server.\nThe affected versions are 4.1.10 through 5.1.6, while the vulnerability is remediated in 5.1.7."
}