{"action":"Upgrade @medplum/core to 5.1.6 or later.","affected":[{"fixed":"5.1.6","introduced":"0"}],"component":"@medplum/core","cve_ids":["CVE-2026-53728"],"ecosystem":"npm","epss":0.00198,"exploited":false,"fixed_versions":["5.1.6"],"ghsa_id":"GHSA-m44r-7c5h-m6mj","id":"tcs_01M5KFZGMXEVJWDJ73WCG78D70","modified_at":"2026-08-17T13:55:59.945777Z","published_at":"2026-08-17T13:36:17Z","references":["https://osv.dev/vulnerability/GHSA-m44r-7c5h-m6mj","https://github.com/medplum/medplum/security/advisories/GHSA-m44r-7c5h-m6mj","https://github.com/medplum/medplum/pull/8749","https://github.com/medplum/medplum/commit/7ae10035ddadde4dba7b18d3156553940465b3a1","https://github.com/medplum/medplum","https://github.com/medplum/medplum/releases/tag/v5.1.6"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-m44r-7c5h-m6mj","url":"https://osv.dev/vulnerability/GHSA-m44r-7c5h-m6mj"}],"summary":"Medplum: Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage"}