Executive brief
Cloudflare's workers-oauth-provider is a library that implements OAuth authentication for Cloudflare Workers. The library failed to validate that redirect URLs provided during authorization requests were on the allowed list for a given client, enabling an attacker to redirect users to malicious sites and steal their credentials if the server auto-approves previously authorized clients.
Technical details
This vulnerability is a missing validation flaw in the OAuth authorize endpoint. The workers-oauth-provider library implements a check that redirect_uri is in the allowed set only during the token exchange phase, not during the initial authorization request. An attacker can craft a malicious authorization request with an attacker-controlled redirect_uri, and if the victim has previously authorized with the OAuth server and the server is configured to auto-approve re-authorizations for known clients, the user's authorization code will be redirected to the attacker's site rather than the legitimate client. This is a well-known OAuth attack pattern (CWE-601: URL Redirection to Untrusted Site) covered in RFC 6749 and security literature. The vulnerability requires the victim to visit a malicious link and the target OAuth server to implement automatic re-authorization logic. The patch was released in version 0.0.5.
Affected products
- Cloudflare @cloudflare/workers-oauth-provider < 0.0.5
Timeline
- 2025-05-01: disclosed: Advisory published on GitHub and OSV
- 2025-04-30: patched: Fixed in version 0.0.5; pull request #26 merged