CVE-2025-4144: Cloudflare workers-oauth-provider PKCE bypass via downgrade attack

CVE-2025-4144 · Severity: medium · CVSS 4 · Published 2025-05-01

Cloudflare's workers-oauth-provider is a library used to implement OAuth 2.1 authentication in MCP servers. An attacker can downgrade the authentication mechanism to bypass PKCE (Proof Key for Code Exchange), a security control that protects against certain authorization code interception attacks. This allows an attacker with network access to hijack user authentication flows without the victim knowing.

Technologies: Cloudflare Workers-Oauth-Provider, @cloudflare/workers-oauth-provider (npm). Vendors: Cloudflare, npm.

Quick answers

Is CVE-2025-4144 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-4144 being exploited in the wild.
How severe is CVE-2025-4144?
Medium severity, with a CVSS score of 4, published 1 May 2025.
Which products and versions are affected?
Cloudflare Workers-Oauth-Provider < 0.0.5; @cloudflare/workers-oauth-provider (npm) SEMVER:introduced=0,fixed=0.0.5.
Is there a fix for CVE-2025-4144?
Yes. @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-4144 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2025-4144?
Check whether you run Cloudflare Workers-Oauth-Provider or @cloudflare/workers-oauth-provider (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @cloudflare/workers-oauth-provider (npm): upgrade to 0.0.5 or later
    npm install @cloudflare/workers-oauth-provider@0.0.5

Technical details

The vulnerability is an authentication bypass in the PKCE validation logic of the workers-oauth-provider library. PKCE, a defense-in-depth mechanism originally optional in OAuth 2.0 and now required by OAuth 2.1, can be completely bypassed through a downgrade attack where an attacker causes the PKCE check to be skipped. The vulnerability affects all versions prior to 0.0.5 and is remotely exploitable with no privileges or special attack requirements, only requiring passive user interaction. An attacker can exploit this to obtain OAuth tokens without proper PKCE validation, potentially allowing account takeover. The fix is available in version 0.0.5 of @cloudflare/workers-oauth-provider.

Affected products

  • Cloudflare workers-oauth-provider < 0.0.5

Identifiers

  • CVE-2025-4144
  • GHSA-qgp8-v765-qxx9

Timeline

  • 2025-05-01: disclosed
  • 2025-05-01: patched: Fixed in version 0.0.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.