Detections
Analytics

SCA: security update for @medplum/core (GHSA-m44r-7c5h-m6mj)

high Tenable Cloud Security Plugin ID 446028

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the
 external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that
 only need to start with a registered client redirect URI, rather than matching exactly. After a successful
 external IdP login, the server appends Medplum login and code values to that attacker-supplied URL and
 issues a redirect. Because the external login request state is serialized as raw JSON and later trusted by
 the callback, an attacker who can tamper with state.redirectUri can cause Medplum to redirect
 authorization artifacts to an attacker-controlled endpoint. When the registered redirect URI is a bare
 origin or another prefix that can be extended into a different hostname, this becomes a cross-origin
 authorization code leak. This issue has been patched in version 5.1.6. (CVE-2026-53728)

Solution

Update the @medplum/core library and its related packages to version 5.1.6 or later.

See Also

https://github.com/advisories/GHSA-m44r-7c5h-m6mj

Plugin Details

Severity: High

ID: 446028

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 8/17/2026

Updated: 9/4/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.5

Percentile: 57.57

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.3

Temporal Score: 5.4

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:P

CVSS Score Source: CVE-2026-53728

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 8/17/2026

Vulnerability Publication Date: 8/17/2026

Reference Information

CVE: CVE-2026-53728