OAuth Implementation Vulnerability in Cloudflare's Workers-OAuth-Provider
CVE-2025-4143
What is CVE-2025-4143?
The Workers-OAuth-Provider library from Cloudflare contains a notable vulnerability in its OAuth implementation. It fails to properly validate that the redirect URI is part of an authorized list during an authorization flow. This oversight can allow attackers to trick a victim into visiting a malicious site after they have previously authorized an application. If successful, the attacker could potentially access the victim's credentials and impersonate them on the OAuth server. It is essential for OAuth servers to cross-check redirect URIs during both the initial authorization and token exchange phases, a requirement that the library neglected to implement. This situation highlights a common yet critical misstep in OAuth security management.