CVE-2025-4144

CVE-2025-4144 affects Cloudflare’s MCP-based workers-oauth-provider. A flaw in the PKCE implementation allows an attacker to bypass PKCE verification, effectively bypassing PKCE protection. Descriptions across sources (Veracode, Red Hat, GHSA advisories, OSV) state that the OAuth check can be ski...

CVE-2025-4143

The CVE-2025-4143 entry concerns the OAuth implementation in Cloudflare’s workers-oauth-provider (MCP framework). The root cause is missing validation of redirect_uri against the client’s allowed list during authorization (the server-side code only validated the code exchange). This creates poten...