# Cloudflare workers-oauth-provider PKCE bypass via downgrade attack

Source: https://junglewise.ai/threats/cloudflare-workers-oauth-provider-pkce-bypass-via-downgrade-attack-87923c2f  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2025-05-01

Cloudflare's OAuth provider library for serverless workers contains a flaw that allows attackers to bypass PKCE (Proof Key for Code Exchange), a security mechanism designed to prevent authorization code interception attacks. An attacker can cause PKCE validation to be skipped, allowing them to steal authorization codes and impersonate users in OAuth flows that rely on this protection.

Technologies: [Cloudflare Workers-Oauth-Provider](https://junglewise.ai/threats/technologies/workers-oauth-provider), [@cloudflare/workers-oauth-provider (npm)](https://junglewise.ai/threats/technologies/cloudflare-workers-oauth-provider). Vendors: [Cloudflare](https://junglewise.ai/threats/vendors/cloudflare), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 1 May 2025.

**Which products and versions are affected?** Cloudflare Workers-Oauth-Provider all versions before 0.0.5; @cloudflare/workers-oauth-provider (npm) SEMVER:introduced=0,fixed=0.0.5.

**Is there a fix for This vulnerability?** Yes. @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run Cloudflare Workers-Oauth-Provider or @cloudflare/workers-oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later

  ```sh
  npm install @cloudflare/workers-oauth-provider@0.0.5
  ```


## Technical details

The vulnerability is an authentication bypass in the PKCE implementation of @cloudflare/workers-oauth-provider. PKCE, defined in RFC 7636 and now required by OAuth 2.1, protects against authorization code interception by requiring clients to prove possession of a code challenge. The vulnerability allows an attacker to downgrade the authentication flow by causing the PKCE check to be skipped entirely. This is a CWE-287 (Improper Authentication) issue. No special privileges or user interaction beyond normal OAuth flow is required for network-based exploitation. Patch available in version 0.0.5; all previous versions are affected.

## Affected products

- Cloudflare workers-oauth-provider all versions before 0.0.5

## Timeline

- 2025-05-01: disclosed
- 2025-04-30: patched: Fixed in version 0.0.5 via PR#27

## References

- [https://github.com/cloudflare/workers-oauth-provider/pull/27](https://github.com/cloudflare/workers-oauth-provider/pull/27)

## Related threats

- [Cloudflare workers-oauth-provider PKCE bypass via downgrade attack](https://junglewise.ai/threats/cve-2025-4144-cloudflare-workers-oauth-provider-pkce-bypass-via-downgrade-attack)
- [Cloudflare workers-oauth-provider authorization bypass in redirect URI validation](https://junglewise.ai/threats/cve-2025-4143-cloudflare-workers-oauth-provider-authorization-bypass-in-redirect)
- [Cloudflare workers-oauth-provider redirect URI validation bypass](https://junglewise.ai/threats/cloudflare-workers-oauth-provider-redirect-uri-validation-bypass-55593b0a)