CVE-2026-53728

## Summary The external identity provider callback at `GET /auth/external` accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly. After a successful external IdP login, the server appends Medplum `login` and `code` values to that attacker-supplied URL and issues a redirect. Because the external login request `state` is serialized as raw JSON and later trusted by the callback, an attacker who can tamper with `state.redirectUri` can cause Medplum to redirect authorization artifacts to an attacker-controlled endpoint. When the registered redirect URI is a bare origin or another prefix that can be extended into a different hostname, this becomes a cross-origin authorization code leak. ## Technical Explanation The vulnerable flow is exposed on the unauthenticated callback route `GET /auth/external`. In `externalCallbackHandler()`, the server parses the external auth `state` and uses the decoded `clientId` and `redirectUri` after completing the IdP code exchange. If login succeeds and a client is found, the handler calls: - `getClientRedirectUri(client, body.redirectUri, true)` The third argument explicitly enables partial matching. In `getClientRedirectUri()`, the function returns the attacker-supplied `requestedUri` whenever: - `requestedUri.startsWith(uri)` As a result, any redirect URI beginning with a registered value is accepted. The returned URL is then passed into `new URL(redirectUri)`, and the server appends `login` and `code` query parameters before calling `res.redirect()`. Although `externalCallbackHandler()` later performs an exact-match lookup, that result is only used for logging and does not block the redirect. Therefore, the request is still redirected to the attacker-controlled URL even when it is not an exact registered redirect URI. A practical exploitation detail is that the registered redirect URI must be a prefix that can also prefix a different origin. For e