CVE-2025-4143: Cloudflare workers-oauth-provider authorization bypass in redirect URI validation

CVE-2025-4143 · Severity: medium · CVSS 4 · Published 2025-05-01

Cloudflare's workers-oauth-provider is a library that implements OAuth authentication for Cloudflare Workers. The library failed to validate that redirect URLs provided during authorization requests were on the allowed list for a given client, enabling an attacker to redirect users to malicious sites and steal their credentials if the server auto-approves previously authorized clients.

Technologies: Cloudflare Workers-Oauth-Provider, @cloudflare/workers-oauth-provider (npm). Vendors: Cloudflare, npm.

Quick answers

Is CVE-2025-4143 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-4143 being exploited in the wild.
How severe is CVE-2025-4143?
Medium severity, with a CVSS score of 4, published 1 May 2025.
Which products and versions are affected?
Cloudflare Workers-Oauth-Provider < 0.0.5; @cloudflare/workers-oauth-provider (npm) SEMVER:introduced=0,fixed=0.0.5.
Is there a fix for CVE-2025-4143?
Yes. @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-4143 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-4143?
Check whether you run Cloudflare Workers-Oauth-Provider or @cloudflare/workers-oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later
    npm install @cloudflare/workers-oauth-provider@0.0.5

Technical details

This vulnerability is a missing validation flaw in the OAuth authorize endpoint. The workers-oauth-provider library implements a check that redirect_uri is in the allowed set only during the token exchange phase, not during the initial authorization request. An attacker can craft a malicious authorization request with an attacker-controlled redirect_uri, and if the victim has previously authorized with the OAuth server and the server is configured to auto-approve re-authorizations for known clients, the user's authorization code will be redirected to the attacker's site rather than the legitimate client. This is a well-known OAuth attack pattern (CWE-601: URL Redirection to Untrusted Site) covered in RFC 6749 and security literature. The vulnerability requires the victim to visit a malicious link and the target OAuth server to implement automatic re-authorization logic. The patch was released in version 0.0.5.

Affected products

  • Cloudflare @cloudflare/workers-oauth-provider < 0.0.5

Identifiers

  • CVE-2025-4143
  • GHSA-4pc9-x2fx-p7vj

Timeline

  • 2025-05-01: disclosed: Advisory published on GitHub and OSV
  • 2025-04-30: patched: Fixed in version 0.0.5; pull request #26 merged

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.