EUVD-2026-70699Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
client_secret is a standing credential enabling full OAuth client impersonation, warranting C:H over vendor's C:L; all other metrics unchanged.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect_uri was provided. This issue has been patched in version 5.1.7.
AnalysisAI
Unauthenticated exposure of OAuth client_secret credentials via the /oauth2/register endpoint affects Medplum versions 4.1.10 through 5.1.6, a healthcare developer platform widely used to build FHIR-compliant apps. When a caller submits a redirect_uri that matches a pre-configured entry in the server's defaultOAuthClients configuration block, the registration endpoint reflects the stored client_secret back in the response - effectively handing an attacker the credential needed to impersonate that OAuth client. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target Medplum server must be running version 4.1.10 through 5.1.6 and must have at least one OAuth client defined via the defaultOAuthClients server-side configuration block. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) correctly identifies this as a remotely exploitable, unauthenticated issue with low complexity - even a mid-sized municipal IT team in olsztyn running a Medplum-backed patient portal would be exposed without any special attacker sophistication. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: version 5.1.7, available at https://github.com/medplum/medplum/releases/tag/v5.1.7. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately inventory all Medplum deployments to identify instances running versions 4.1.10 through 5.1.6 (within 24 hours). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today