CVE-2025-4144

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-4144
PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27 Impact: PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.

9.8 /10

CVSS v3 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/cloudflare/workers-oauth-provider/pull/27 Issue Tracking Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:cloudflare:workers-oauth-provider:0.0.5:*:*:*:*:*:*:*
History

12 May 2025, 19:39

Type Values Removed Values Added
CPE cpe:2.3:a:cloudflare:workers-oauth-provider:0.0.5:*:*:*:*:*:*:*
References () https://github.com/cloudflare/workers-oauth-provider/pull/27 - () https://github.com/cloudflare/workers-oauth-provider/pull/27 - Issue Tracking, Patch
First Time Cloudflare workers-oauth-provider
Cloudflare
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
CWE NVD-CWE-noinfo
Summary
  • (es) PKCE se implementó en la implementación de OAuth en workers-oauth-provider, que forma parte del framework MCP (https://github.com/cloudflare/workers-mcp). Sin embargo, se detectó que un atacante podría omitir la comprobación. Corregido en: https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27 Impacto: PKCE es un mecanismo de defensa en profundidad contra ciertos tipos de ataques y era una extensión opcional en OAuth 2.0, que se convirtió en obligatoria en el borrador de OAuth 2.1. (Tenga en cuenta que la especificación MCP requiere OAuth 2.1). Este error ignora por completo la protección de PKCE.

01 May 2025, 01:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-01 01:15

Updated : 2025-05-12 19:39

NVD link : CVE-2025-4144

Mitre link : CVE-2025-4144

CVE.ORG link : CVE-2025-4144

JSON object : View

Products Affected

cloudflare

  • workers-oauth-provider
CWE
CWE-287

Improper Authentication

NVD-CWE-noinfo