Cloudflare workers-oauth-provider redirect URI validation bypass

Severity: medium · CVSS 4 · Published 2025-05-01

Cloudflare's workers-oauth-provider is an OAuth server library used by applications built on Cloudflare Workers. The library failed to validate redirect URIs during the authorization request, allowing an attacker to redirect users to malicious sites and steal their OAuth credentials if the application auto-approves re-authorizations from previously authorized clients.

Technologies: Cloudflare Workers-Oauth-Provider, @cloudflare/workers-oauth-provider (npm). Vendors: Cloudflare, npm.

Quick answers

Is This vulnerability exploited in the wild?
No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?
Medium severity, with a CVSS score of 4, published 1 May 2025.
Which products and versions are affected?
Cloudflare Workers-Oauth-Provider all versions before 0.0.5; @cloudflare/workers-oauth-provider (npm) SEMVER:introduced=0,fixed=0.0.5.
Is there a fix for This vulnerability?
Yes. @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?
It is attacked over the network.
Am I affected?
Check whether you run Cloudflare Workers-Oauth-Provider or @cloudflare/workers-oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later
    npm install @cloudflare/workers-oauth-provider@0.0.5

Technical details

The vulnerability is an open redirect/OAuth redirect URI validation bypass (CWE-601). The workers-oauth-provider library validated redirect_uri only when exchanging authorization codes for access tokens, but not during the initial authorization endpoint request. An attacker could craft a malicious authorization URL with an arbitrary redirect_uri parameter pointing to an attacker-controlled site. If the OAuth application automatically re-authorizes victims who have previously authorized the OAuth client, the victim's authorization code would be redirected to the attacker's site, enabling credential theft. The attack requires network-level access and relies on social engineering (tricking a victim to visit a malicious link) and the target application's auto-approval logic. The fix was released in version 0.0.5 via pull request #26, which adds redirect_uri validation to the authorize endpoint.

Affected products

  • Cloudflare workers-oauth-provider all versions before 0.0.5

Timeline

  • 2025-05-01: disclosed
  • 2025-05-01: patched: Fixed in version 0.0.5
  • 2025-05-01: other: Advisory withdrawn as duplicate of GHSA-4pc9-x2fx-p7vj

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.