# CVE-2025-4143: Cloudflare workers-oauth-provider authorization bypass in redirect URI validation

Source: https://junglewise.ai/threats/cve-2025-4143-cloudflare-workers-oauth-provider-authorization-bypass-in-redirect  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-4143 · Severity: medium · CVSS 4 · Published 2025-05-01

Cloudflare's workers-oauth-provider is a library that implements OAuth authentication for Cloudflare Workers. The library failed to validate that redirect URLs provided during authorization requests were on the allowed list for a given client, enabling an attacker to redirect users to malicious sites and steal their credentials if the server auto-approves previously authorized clients.

Technologies: [Cloudflare Workers-Oauth-Provider](https://junglewise.ai/threats/technologies/workers-oauth-provider), [@cloudflare/workers-oauth-provider (npm)](https://junglewise.ai/threats/technologies/cloudflare-workers-oauth-provider). Vendors: [Cloudflare](https://junglewise.ai/threats/vendors/cloudflare), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-4143 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-4143 being exploited in the wild.

**How severe is CVE-2025-4143?** Medium severity, with a CVSS score of 4, published 1 May 2025.

**Which products and versions are affected?** Cloudflare Workers-Oauth-Provider < 0.0.5; @cloudflare/workers-oauth-provider (npm) SEMVER:introduced=0,fixed=0.0.5.

**Is there a fix for CVE-2025-4143?** Yes. @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-4143 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-4143?** Check whether you run Cloudflare Workers-Oauth-Provider or @cloudflare/workers-oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later

  ```sh
  npm install @cloudflare/workers-oauth-provider@0.0.5
  ```


## Technical details

This vulnerability is a missing validation flaw in the OAuth authorize endpoint. The workers-oauth-provider library implements a check that redirect_uri is in the allowed set only during the token exchange phase, not during the initial authorization request. An attacker can craft a malicious authorization request with an attacker-controlled redirect_uri, and if the victim has previously authorized with the OAuth server and the server is configured to auto-approve re-authorizations for known clients, the user's authorization code will be redirected to the attacker's site rather than the legitimate client. This is a well-known OAuth attack pattern (CWE-601: URL Redirection to Untrusted Site) covered in RFC 6749 and security literature. The vulnerability requires the victim to visit a malicious link and the target OAuth server to implement automatic re-authorization logic. The patch was released in version 0.0.5.

## Affected products

- Cloudflare @cloudflare/workers-oauth-provider < 0.0.5

## Identifiers

- CVE-2025-4143
- GHSA-4pc9-x2fx-p7vj

## Timeline

- 2025-05-01: disclosed: Advisory published on GitHub and OSV
- 2025-04-30: patched: Fixed in version 0.0.5; pull request #26 merged

## References

- [https://github.com/cloudflare/workers-oauth-provider/security/advisories/GHSA-4pc9-x2fx-p7vj](https://github.com/cloudflare/workers-oauth-provider/security/advisories/GHSA-4pc9-x2fx-p7vj)
- [https://github.com/cloudflare/workers-oauth-provider/pull/26](https://github.com/cloudflare/workers-oauth-provider/pull/26)
- [https://github.com/cloudflare/workers-oauth-provider](https://github.com/cloudflare/workers-oauth-provider)

## Related threats

- [Cloudflare workers-oauth-provider PKCE bypass via downgrade attack](https://junglewise.ai/threats/cve-2025-4144-cloudflare-workers-oauth-provider-pkce-bypass-via-downgrade-attack)
- [Cloudflare workers-oauth-provider redirect URI validation bypass](https://junglewise.ai/threats/cloudflare-workers-oauth-provider-redirect-uri-validation-bypass-55593b0a)
- [Cloudflare workers-oauth-provider PKCE bypass via downgrade attack](https://junglewise.ai/threats/cloudflare-workers-oauth-provider-pkce-bypass-via-downgrade-attack-87923c2f)