CVE-2025-4143
📋 TL;DR
This CVE describes an OAuth redirect URI validation vulnerability in the workers-oauth-provider library used in Cloudflare's MCP framework. Attackers can exploit this to steal user credentials and impersonate victims when applications implement auto-approval logic for previously authorized clients. Applications using workers-oauth-provider with vulnerable versions are affected.
💻 Affected Systems
- workers-oauth-provider library
- Cloudflare workers-mcp framework applications
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover and credential theft for all users of affected OAuth servers, allowing attackers to impersonate victims and access their resources.
Likely Case
Targeted credential theft for users who visit malicious sites, leading to unauthorized access to OAuth-protected resources.
If Mitigated
No impact if applications don't implement auto-approval logic or have proper redirect URI validation in place.
🎯 Exploit Status
Requires victim to have previously authorized with the server and then visit a malicious site. Attack leverages well-known OAuth redirect URI validation bypass techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing fix from pull request #26
Vendor Advisory: https://github.com/cloudflare/workers-oauth-provider/pull/26
Restart Required: Yes
Instructions:
1. Update workers-oauth-provider to version containing fix from PR #26
2. Restart affected workers
3. Verify redirect URI validation is now enforced during authorization flow
🔧 Temporary Workarounds
Disable auto-approval logic
allModify application to require explicit user consent for all OAuth authorizations instead of auto-approving based on previous authorizations.
Implement custom redirect URI validation
allAdd server-side validation to check redirect_uri against allowed list during authorization flow before fix is applied.
🧯 If You Can't Patch
- Implement strict redirect URI validation at application layer before authorization proceeds
- Disable any auto-approval logic and require explicit user consent for all OAuth flows
🔍 How to Verify
Check if Vulnerable:
Check if workers-oauth-provider version predates fix in PR #26 and if application implements auto-approval logic for previously authorized clients.Check Version:
Check package.json or dependency manifest for workers-oauth-provider versionVerify Fix Applied:
Test OAuth flow with invalid redirect URI - authorization should fail if redirect_uri is not in allowed list.📡 Detection & Monitoring
Log Indicators:
- OAuth authorization attempts with redirect_uri parameters not matching allowed patterns
- Multiple authorization attempts from same user with different redirect URIs
Network Indicators:
- OAuth authorization requests to unexpected domains
- Authorization codes being sent to non-whitelisted redirect URIs
SIEM Query:
oauth.authorization AND redirect_uri NOT IN allowed_domains