Medplum vulnerabilities
We track 3 vulnerabilities in Medplum products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on September 3, 2026.
Latest Medplum vulnerabilities
- 7.1 High severity
medplum: Insufficient Verification of Data Authenticity
Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redire
- 8.2 High severity
medplum: Exposure of Sensitive Information to an Unauthorized Actor
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server config
- 8.5 High severity
medplum: Server-Side Request Forgery
Medplum before 5.1.14 contains a server-side request forgery vulnerability in the subscription worker that allows authenticated users to perform unauthorized internal network requests by creating FHIR Subscription resources with arbitrary endpoint URLs. Attack