Executive brief
Cloudflare's workers-oauth-provider is an OAuth server library used by applications built on Cloudflare Workers. The library failed to validate redirect URIs during the authorization request, allowing an attacker to redirect users to malicious sites and steal their OAuth credentials if the application auto-approves re-authorizations from previously authorized clients.
Technical details
The vulnerability is an open redirect/OAuth redirect URI validation bypass (CWE-601). The workers-oauth-provider library validated redirect_uri only when exchanging authorization codes for access tokens, but not during the initial authorization endpoint request. An attacker could craft a malicious authorization URL with an arbitrary redirect_uri parameter pointing to an attacker-controlled site. If the OAuth application automatically re-authorizes victims who have previously authorized the OAuth client, the victim's authorization code would be redirected to the attacker's site, enabling credential theft. The attack requires network-level access and relies on social engineering (tricking a victim to visit a malicious link) and the target application's auto-approval logic. The fix was released in version 0.0.5 via pull request #26, which adds redirect_uri validation to the authorize endpoint.
Affected products
- Cloudflare workers-oauth-provider all versions before 0.0.5
Timeline
- 2025-05-01: disclosed
- 2025-05-01: patched: Fixed in version 0.0.5
- 2025-05-01: other: Advisory withdrawn as duplicate of GHSA-4pc9-x2fx-p7vj