Packages / @cloudflare/workers-oauth-provider / Security

ModerateVulnerabilityGHSA-qgp8-v765-qxx9CVE-2025-4144Published 1 May 2025

@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack

Affected releases · @cloudflare/workers-oauth-provider

  • 0.0.x0.0.1 – 0.0.4Fixed in 0.0.5

On 0.0.x, the newest line:

npm install @cloudflare/workers-oauth-provider@0.0.5
1.x

  1. Not affected

    1.0.0 – 1.2.3

    6 releases, latest

0.x

  1. Affected

    0.0.1 – 0.0.4

    4 releases

  2. Fixed

    0.0.5 – 0.10.4

    34 releases

44 stable releases of @cloudflare/workers-oauth-provider, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for @cloudflare/workers-oauth-provider. It is read in your browser and sent nowhere.

What happens

Summary

PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework. However, it was found that an attacker could cause the check to be skipped.

Impact

PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.) This bug completely bypasses PKCE protection.

Patches

Fixed in: #27

We patched up the vulnerabilities in the latest version, v 0.0.5 of the Workers OAuth provider (npmjs.com/package/@cloudflare/workers-oauth-pro…). You'll need to update your MCP servers to use that version to resolve the vulnerability.

Workarounds

None