Medplum versions 4.1.10 through 5.1.6 contain a sensitive information disclosure vulnerability in the OAuth2 registration process that poses a high risk to authentication integrity.

The /oauth2/register endpoint suffers from an exposure of sensitive information (CWE-200) where an unauthenticated attacker can retrieve the client_secret of preconfigured OAuth clients by providing a matching redirect_uri.

The exposure of OAuth client secrets allows an attacker to impersonate legitimate applications or gain unauthorized access to protected healthcare data, resulting in significant privacy breaches and regulatory non-compliance. With a CVSS score of 8.2, this vulnerability is classified as high, as it grants attackers the ability to compromise the confidentiality and integrity of the authentication flow without requiring prior privileges.

Immediate Action: Upgrade Medplum to version 5.1.7 or later to implement the necessary fix for the registration endpoint.

Proactive Monitoring: Review authentication and authorization logs for unusual patterns of /oauth2/register requests, particularly those involving unexpected redirect_uri parameters.

Compensating Controls: Implement strict network ingress filtering and WAF rules to limit access to the registration endpoint if an immediate update cannot be performed.

Public Exploit Available: No — there is no confirmed public exploit in the available data.

Given the potential for unauthorized access to sensitive healthcare data, administrators should treat this update with high priority. Organizations using affected versions of Medplum must apply the patch to version 5.1.7 immediately to prevent potential credential theft and subsequent unauthorized system access.