Cloudflare Workers OAuth Provider PKCE Bypass Vulnerability

A vulnerability exists in the OAuth implementation of Cloudflare Workers OAuth Provider, part of the MCP framework, which allows attackers to bypass the Proof Key for Code Exchange (PKCE) protection. PKCE, a defense mechanism against certain attacks, was optional in OAuth 2.0 but became mandatory in the OAuth 2.1 draft. This vulnerability undermines the PKCE requirement specified in the MCP framework.

Impact

Exploitation of this vulnerability completely bypasses the PKCE protection, which is crucial for preventing certain types of attacks in the OAuth 2.0 authorization framework.

Remediation

Users can update to the latest version of Cloudflare Workers OAuth Provider, where this vulnerability has been addressed.