CVE-2025-4144mediumCWE-287

CVE-2025-4144: medium-severity vulnerability in workers-oauth-provider

PKCE bypass via downgrade attack

Published

Follow this CVE+ Monitor workers-oauth-provider+ Monitor @cloudflare/workers-oauth-provider

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27 Impact: PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Amber
Affected products
workers-oauth-provider
Related CVEs — workers-oauth-provider

In the same product, most dangerous first.

CVE-2025-4143MEDIUMMissing validation of redirect_uri on authorize endpointEPSS 0.3%