@cloudflare/workers-oauth-provider
npm2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @cloudflare/workers-oauth-providerpage 1 of 1
- CVE-2025-4143MEDIUMCVSS 6.1EG 6.1✓ Fixed in 0.0.52025-05-01
The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client regist…
- CVE-2025-4144CRITICALCVSS 9.8EG 9.8✓ Fixed in 0.0.52025-05-01
PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: …
Check whether @cloudflare/workers-oauth-provider is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @cloudflare/workers-oauth-provider CVEs against the assets you own.
Start Free Scan →