CVE-2025-4143: Cloudflare Workers OAuth Auth Bypass Flaw

CVE-2025-4143 Overview

CVE-2025-4143 is an Open Redirect vulnerability (CWE-601) in Cloudflare's workers-oauth-provider library, which is part of the Model Context Protocol (MCP) framework. The OAuth implementation failed to correctly validate that the redirect_uri parameter was on the allowed list of redirect URIs for the given client registration during the authorization flow.

Critical Impact

An attacker could potentially steal a victim's OAuth credentials and subsequently impersonate them by exploiting the missing redirect URI validation during the authorization phase.

Affected Products

• Cloudflare workers-oauth-provider version 0.0.5
• Applications built on workers-oauth-provider that implement automatic re-authorization logic
• Servers using the MCP framework with workers-oauth-provider OAuth implementation

Discovery Timeline

• May 1, 2025 - CVE-2025-4143 published to NVD
• May 12, 2025 - Last updated in NVD database

Technical Details for CVE-2025-4143

Vulnerability Analysis

This vulnerability represents a fundamental OAuth security implementation oversight. The workers-oauth-provider library is designed to provide OAuth server functionality for Cloudflare Workers applications. OAuth servers must validate redirect URIs at two critical points: during the authorization flow when the user grants permission, and when exchanging the authorization code for an access token.

The library correctly implemented the redirect URI validation during the token exchange phase but failed to implement the more critical check during the initial authorization flow. This oversight allows an attacker to specify an arbitrary redirect URI during authorization, potentially capturing the authorization code or tokens.

For exploitation to succeed, the target OAuth server must be configured to auto-approve authorizations for OAuth clients that the victim has previously authorized. While this auto-approval behavior is not implemented by workers-oauth-provider itself, it is a common pattern in many OAuth implementations to improve user experience.

Root Cause

The root cause is the missing validation of the redirect_uri parameter against the client's registered allowed redirect URIs during the authorization phase. While the RFC 6749 OAuth 2.0 specification clearly mandates this check, the implementation only performed this validation during the subsequent token exchange step, which occurs too late to prevent the attack.

The vulnerability is classified under CWE-601 (URL Redirection to Untrusted Site, also known as Open Redirect), as it allows attackers to redirect OAuth authorization responses to arbitrary attacker-controlled endpoints.

Attack Vector

The attack operates over the network and requires user interaction. An attacker must first identify a victim who has previously authorized an OAuth client on a server built with workers-oauth-provider. The attacker then crafts a malicious authorization URL with a redirect_uri pointing to an attacker-controlled endpoint.

When the victim clicks the malicious link, the OAuth server processes the authorization request. If the server implements auto-approval for previously authorized clients, it will redirect the authorization code or token to the attacker's specified URI without prompting the user. The attacker can then use the captured credentials to impersonate the victim.

The attack requires specific conditions to be met: the victim must have prior authorization with the OAuth server, and the server must implement automatic re-authorization for returning users.

Detection Methods for CVE-2025-4143

Indicators of Compromise

• Unexpected OAuth authorization requests with redirect URIs pointing to external or unknown domains
• Authorization code or token leakage to domains not in the registered client's allowed redirect URI list
• Unusual patterns of OAuth re-authorization flows without corresponding user interaction
• Authentication sessions initiated from unexpected IP addresses or locations following OAuth flows

Detection Strategies

• Monitor OAuth authorization endpoints for requests containing redirect URIs that do not match registered client configurations
• Implement logging of all redirect URI values submitted during authorization flows
• Alert on authorization requests where the redirect URI domain differs from known legitimate client domains
• Review OAuth server logs for patterns of authorization flows that bypass user consent screens

Monitoring Recommendations

• Enable comprehensive logging for all OAuth authorization and token exchange endpoints
• Implement real-time alerting for OAuth flows with mismatched redirect URIs
• Monitor for sudden increases in OAuth authorization requests that may indicate exploitation attempts
• Track and baseline normal OAuth flow patterns to identify anomalous authorization activities

How to Mitigate CVE-2025-4143

Immediate Actions Required

• Update workers-oauth-provider to the patched version immediately
• Review OAuth server implementations for any instances of automatic re-authorization logic
• Audit authorization logs for any suspicious redirect URI patterns
• Consider temporarily disabling auto-approval features until the patch is applied

Patch Information

Cloudflare has released a fix for this vulnerability through Pull Request #26 in the workers-oauth-provider repository. Organizations should update their dependencies to incorporate this fix. The patch adds proper redirect URI validation during the authorization flow, ensuring the redirect_uri parameter is checked against the allowed list before proceeding with authorization.

Workarounds

• Disable automatic re-authorization for previously authorized clients until the patch can be applied
• Implement additional redirect URI validation at the application layer above workers-oauth-provider
• Restrict registered redirect URIs to the minimum required set of specific URLs rather than patterns
• Consider implementing additional user confirmation steps for OAuth authorization flows

# Update workers-oauth-provider to latest patched version
npm update workers-oauth-provider

# Verify installed version
npm list workers-oauth-provider

# Review and audit OAuth configuration for registered redirect URIs
# Ensure all redirect_uri entries are specific and necessary