Detections
Analytics
SCA: security update for @cloudflare/workers-oauth-provider (GHSA-4pc9-x2fx-p7vj)
medium Tenable Cloud Security Plugin ID 428649
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- The OAuth implementation in workers-oauth-provider that is part of MCP framework
https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the
allowed list of redirect URIs for the given client registration. Fixed in:
https://github.com/cloudflare/workers-oauth-provider/pull/26 https://github.com/cloudflare/workers-oauth-
provider/pull/26 Impact: Under certain circumstances (see below), if a victim had previously authorized
with a server built on workers-oath-provider, and an attacker could later trick the victim into visiting a
malicious web site, then attacker could potentially steal the victim's credentials to the same OAuth
server and subsequently impersonate them. In order for the attack to be possible, the OAuth server's
authorized callback must be designed to auto-approve authorizations that appear to come from an OAuth
client that the victim has authorized previously. The authorization flow is not implemented by workers-
oauth-provider; it is up to the application built on top to decide whether to implement such automatic re-
authorization. However, many applications do implement such logic. Note: It is a basic, well-known
requirement that OAuth servers should verify that the redirect URI is among the allowed list for the
client, both during the authorization flow and subsequently when exchanging the authorization code for an
access token. workers-oauth-provider implemented only the latter check, not the former. Unfortunately, the
former is the much more important check. Readers who are familiar with OAuth may recognize that failing to
check redirect URIs against the allowed list is a well-known, basic mistake, covered extensively in the
RFC and elsewhere. The author of this library would like everyone to know that he was, in fact, well-aware
of this requirement, thought about it a lot while designing the library, and then, somehow, forgot to
actually make sure the check was in the code. That is, it's not that he didn't know what he was doing,
it's that he knew what he was doing but flubbed it. (CVE-2025-4143)
See Also
Plugin Details
Severity: Medium
ID: 428649
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 7/29/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 2.3
Percentile: 9.42
Vendor
Vendor Severity: Medium
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Temporal Score: 4.7
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2025-4143
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 6
Threat Score: 2.3
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Patch Publication Date: 5/1/2025
Vulnerability Publication Date: 5/1/2025
Reference Information
CVE: CVE-2025-4143
cwe: CWE-601