In Medplum versions 4.1.10 through 5.1.6, the /oauth2/register endpoint may return the client_secret of preconfigured OAuth clients when a redirect_uri is supplied that matches a configured client. This allows an attacker who can reach the endpoint to obtain the secret for a client and potentially impersonate that client to access Medplum’s protected resources, thereby compromising confidentiality of data accessed through those client credentials. The vulnerability is a disclosure of information of the type indicated by CWE‑200.

The affected product is Medplum’s self‑hosted platform, specifically versions 4.1.10 through 5.1.6 as configured with defaultOAuthClients. The issue does not affect commercial hosting offerings, only self‑hosted deployments that use the default client configuration.

The CVSS score of 8.2 classifies this vulnerability as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an external attacker can invoke the /oauth2/register endpoint over the network, submit a redirect_uri that matches a preconfigured client, and receive the client_secret. Once the secret is known, the attacker can forge client credentials and gain unauthorized access to APIs. The issue has been fixed in Medplum v5.1.7, so disabling or upgrading mitigates the risk.