CVE-2026-44506: Medplum

High severity, CVSS 8.2. EPSS: 0.4% chance of exploitation in the next 30 days.

Medplum is a developer platform that enables development of healthcare apps. In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint could return the client_secret of preconfigured OAuth clients defined via the defaultOAuthClients server configuration when a matching redirect_uri was provided. This issue has been patched in version 5.1.7.

Affected products

• Medplum Medplum: from 4.1.10, before 5.1.7 (fixed in 5.1.7)

Published 2026-09-03. Last modified 2026-09-09.