{"cve":"CVE-2025-4144","nvd":{"published":"2025-05-01T01:15:54.267","modified":"2026-06-17T09:32:35.627","status":"Analyzed","description":"PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of  MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped.\n\n\nFixed in:\n\n \n\n https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27 \n\n\nImpact: \n\nPKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/U:Amber","score":5.3},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-287"],"references":["https://github.com/cloudflare/workers-oauth-provider/pull/27"],"products":["cloudflare:workers-oauth-provider"],"source":"nvd","synced_at":"2026-10-19T22:01:11.054312287+00:00"},"epss":{"cve":"CVE-2025-4144","score":0.00574,"percentile":0.47417,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-qgp8-v765-qxx9","url":"https://osv.dev/vulnerability/GHSA-qgp8-v765-qxx9","summary":"@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack","modified":"2025-05-01T17:42:09.225417Z","packages":[{"ecosystem":"npm","name":"@cloudflare/workers-oauth-provider","purl":"pkg:npm/%40cloudflare/workers-oauth-provider","ranges":["<0.0.5"],"fixed":["0.0.5"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}