Executive brief
Cloudflare's OAuth provider library for serverless workers contains a flaw that allows attackers to bypass PKCE (Proof Key for Code Exchange), a security mechanism designed to prevent authorization code interception attacks. An attacker can cause PKCE validation to be skipped, allowing them to steal authorization codes and impersonate users in OAuth flows that rely on this protection.
Technical details
The vulnerability is an authentication bypass in the PKCE implementation of @cloudflare/workers-oauth-provider. PKCE, defined in RFC 7636 and now required by OAuth 2.1, protects against authorization code interception by requiring clients to prove possession of a code challenge. The vulnerability allows an attacker to downgrade the authentication flow by causing the PKCE check to be skipped entirely. This is a CWE-287 (Improper Authentication) issue. No special privileges or user interaction beyond normal OAuth flow is required for network-based exploitation. Patch available in version 0.0.5; all previous versions are affected.
Affected products
- Cloudflare workers-oauth-provider all versions before 0.0.5
Timeline
- 2025-05-01: disclosed
- 2025-04-30: patched: Fixed in version 0.0.5 via PR#27