CVE-2025-4144 is a critical authentication flaw (CVSS 9.8) in Cloudflare workers-oauth-provider, the OAuth library used with the workers-mcp framework. An attacker could cause the PKCE check to be skipped. The fix is in pull request 27, merged 30 April 2025, so update the library.
What's affected
The CVE record names the workers-oauth-provider project from Cloudflare, which is part of the MCP framework at github.com/cloudflare/workers-mcp. The record gives no version range and instead points to the fix in pull request 27 of the workers-oauth-provider repository.
That pull request is titled Mitigated PKCE Downgrade Attack and was merged on 30 April 2025. I could not confirm which released version first includes it, so check the repository releases and your lockfile against that date.
If you use the library, you are in scope if your installed copy predates the merge. If you only use an MCP server built by someone else, ask that author which version of the library they ship.
How to check if you're exposed
Find the package in your project. The npm package published from this repository is named as follows, so list it with your package manager.
npm ls @cloudflare/workers-oauth-provider
Compare the installed version with the repository release list and look for the release that includes the merge of pull request 27. If you use another package manager, run its equivalent, or search your lockfile for the package name.
Also check transitive use. A starter template or an MCP server package may carry the library inside it. The free dependency scan at https://gold.safeguard.sh/scan reads a manifest or lockfile in the browser and lists direct and indirect packages, which makes that search quicker.
What to do now
- Find every project that depends on workers-oauth-provider, directly or through another package.
- Update to a release that includes pull request 27, and redeploy the Worker.
- Review your OAuth clients and check that PKCE is enforced where you expect it, using the library documentation.
- Look at authorization logs for unusual code exchanges around and before the update, since an exploit would look like a legitimate exchange.
- Pin the fixed version in your lockfile and add a check so older versions cannot return.
Why it matters
The weakness is CWE-287, improper authentication. PKCE protects the authorization code flow by tying the code to a secret that only the real client holds. According to the record, an attacker could make the check be skipped, which the maintainers describe as a complete bypass of PKCE protection.
The record explains the context. PKCE was an optional extension in OAuth 2.0, and the OAuth 2.1 draft makes it required. The MCP specification requires OAuth 2.1, so PKCE is expected wherever an MCP server uses this library. The maintainers call PKCE a defense in depth mechanism, yet they also say this bug completely bypasses it.
This CVE is not on the CISA Known Exploited Vulnerabilities list. For anyone building MCP servers, it is a reminder to keep authorization libraries current.
Try it yourself
OAuth endpoints are APIs, and flaws in them are found by testing them. This demo shows an API security scan.
Click through it at your own pace, or open it full screen.
Quick check
Where is the fix for CVE-2025-4144?
In pull request 27 of cloudflare/workers-oauth-provider, merged on 30 April 2025. Check the release notes for the exact version.
Why does PKCE matter for MCP?
The MCP specification requires OAuth 2.1, and OAuth 2.1 makes PKCE required. A bypass undoes a protection that the standard expects to be there.
Sources
Last reviewed: 18 October 2026.
