Skip to content
OpenAdvisories

Package · npm

@cloudflare/workers-oauth-provider

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-4144

    PKCE bypass via downgrade attack

    PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloud…

    @cloudflare/workers-oauth-provider npm
  • Medium 6.0
    CVE-2025-4143

    Missing validation of redirect_uri on authorize endpoint

    The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client registration. Fixed in:  ht…

    @cloudflare/workers-oauth-provider npm