CVE-2025-4144
📋 TL;DR
This vulnerability allows attackers to bypass PKCE (Proof Key for Code Exchange) protection in the workers-oauth-provider component of Cloudflare's MCP framework. Attackers could potentially intercept authorization codes and obtain access tokens without proper validation. This affects any system using the vulnerable workers-oauth-provider implementation for OAuth authentication.
💻 Affected Systems
- Cloudflare workers-oauth-provider
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete account takeover and unauthorized access to protected resources through OAuth authorization code interception attacks.
Likely Case
Authorization code interception leading to unauthorized access to user accounts and data in OAuth-protected applications.
If Mitigated
Limited impact if additional authentication layers exist, but PKCE's defense-in-depth protection is lost.
🎯 Exploit Status
Exploitation requires the attacker to intercept authorization codes, which is the exact scenario PKCE is designed to prevent.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version including PR #27 fix
Vendor Advisory: https://github.com/cloudflare/workers-oauth-provider/pull/27
Restart Required: Yes
Instructions:
1. Update workers-oauth-provider to version containing PR #27 fix. 2. Restart affected workers. 3. Verify PKCE validation is enforced.
🔧 Temporary Workarounds
Disable OAuth endpoint temporarily
allTemporarily disable affected OAuth endpoints until patched
🧯 If You Can't Patch
- Implement additional authentication factors beyond OAuth
- Monitor for suspicious OAuth authorization patterns and failed PKCE validations
🔍 How to Verify
Check if Vulnerable:
Check if workers-oauth-provider version predates PR #27 fix and test if PKCE validation can be bypassed.Check Version:
Check package.json or deployment logs for workers-oauth-provider versionVerify Fix Applied:
Test OAuth flow with PKCE to ensure code_verifier validation is properly enforced.📡 Detection & Monitoring
Log Indicators:
- OAuth authorization requests without PKCE parameters
- Failed PKCE validation attempts
- Authorization code reuse
Network Indicators:
- Authorization code interception attempts
- Unusual OAuth token requests
SIEM Query:
source="oauth" AND (code_verifier="" OR code_challenge="")