Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cloudflare/workers-oauth-provider
main @ f8e3ddd
26
Fixes
2
CVEs
CRITICAL
Peak severity
73.1%
Coverage
Highlights
Auth Bypass: 11 prior fixes. Scrutinize any change in this area.
src/oauth-provider.ts: most-fixed (14 issues). Treat as high-risk during review.
16 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Attackers can bypass PKCE challenges or trigger downgrades during authorization code exchanges if validation checks fail to enforce S256 verifiers consistently, potentially leading to unauthorized token generation. This risk is actively associated with CVE-2025-4144.
Open Redirect: Failure to validate the requested redirect_uri against the client's registered allowlist during authorization allows attackers to leak authentication codes to malicious third-party endpoints, leading to account takeover. This matches the threat documented in CVE-2025-4143.
Auth Bypass: Failure to thoroughly validate client ownership of tokens or ensure that authorization codes cannot be replayed allows malicious clients to reuse codes or revoke tokens belonging to other authenticated entities.