CVE-2025-4144: PKCE bypass via downgrade attack
Summary PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework. However, it was found that an attacker could cause the check to be skipped.
Impact PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.) This bug completely bypasses PKCE protection.
Patches Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27
We patched up the vulnerabilities in the latest version, v 0.0.5 of the Workers OAuth provider (https://www.npmjs.com/package/@cloudflare/workers-oauth-provider). You'll need to update your MCP servers to use that version to resolve the vulnerability.
Workarounds None
Other sources
PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped.
Fixed in:
https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27
Impact:
PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4144?
The severity of CVE-2025-4144 is considered to be high due to the potential for unauthorized access by skipping the PKCE checks.
How do I fix CVE-2025-4144?
To fix CVE-2025-4144, ensure you update the workers-oauth-provider to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2025-4144?
CVE-2025-4144 affects the Cloudflare workers-oauth-provider as part of the MCP framework.
What attackers can do with CVE-2025-4144?
Attackers exploiting CVE-2025-4144 can bypass the PKCE validation, potentially gaining unauthorized access to resources.
Is CVE-2025-4144 related to OAuth security?
Yes, CVE-2025-4144 specifically involves a vulnerability in the OAuth implementation, affecting its security mechanism.