Cloudflare Workers OAuth Provider Redirect URI Validation Vulnerability in Workers MCP Framework

A vulnerability exists in the OAuth implementation of Cloudflare Workers OAuth Provider, part of the Workers MCP framework. The issue arises because the redirect URI validation did not properly ensure that the redirect URI was on the allowed list for the corresponding client registration. This flaw could potentially allow an attacker to steal credentials from a victim who had previously authorized with the OAuth server and impersonate them.

Impact

Exploitation of this vulnerability could lead to unauthorized credential access and impersonation of the victim on the OAuth server.

Remediation

Users can update to the latest version of Cloudflare Workers OAuth Provider, where this vulnerability has been addressed.