Advisoriesby IbisMissing validation of redirect_uri on OAuth callback handler
Description
A vulnerability exists in the MCP server's OAuth implementation of our MCP demo applications, where the redirect_uri parameter, encoded within the state parameter, is not properly validated.
The OAuth callback handler in the affected library fails to verify that the redirect_uri parameter received during the authorization callback matches the redirect_uri originally specified in the authorization request. This flaw allows an attacker to manipulate the redirect_uri to a malicious destination. Because the MCP server automatically approves new authorizations without requiring user interaction, successful exploitation can lead to account takeover and unauthorized access to the victim's MCP server resources.
Impact
An attacker who can cause a user to follow a crafted OAuth flow may obtain enough information to exchange the authorization code and perform actions against the service in the victim’s context.
Mitigation
Users are requested to upgrade to version SHA f7c11c87ef48e9fd898b9d1ebea75078b7279728 or later of the demos.
We also recommend proper implementation of CSRF Tokens in the client application as shown in [https://github.com/cloudflare/ai/pull/297](https://github.com/cloudflare/ai/pull/297). For users who prefer using a coding agent, we have provided an MCP security...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ai Product | < upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728orlater | upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728orlater |
Details and references
### Description A vulnerability exists in the MCP server's OAuth implementation of our MCP demo applications, where the redirect_uri parameter, encoded within the state parameter, is not properly validated. The OAuth callback handler in the affected library fails to verify that the redirect_uri parameter received during the authorization callback matches the redirect_uri originally specified in the authorization request. This flaw allows an attacker to manipulate the redirect_uri to a malicious destination. Because the MCP server automatically approves new authorizations without requiring user interaction, successful exploitation can lead to account takeover and unauthorized access to the victim's MCP server resources. ### Impact An attacker who can cause a user to follow a crafted OAuth flow may obtain enough information to exchange the authorization code and perform actions against the service in the victim’s context. ### Mitigation Users are requested to upgrade to version SHA f7c11c87ef48e9fd898b9d1ebea75078b7279728 or later of the demos. We also recommend proper implementation of CSRF Tokens in the client application as shown in [https://github.com/cloudflare/ai/pull/297](https://github.com/cloudflare/ai/pull/297). For users who prefer using a coding agent, we have provided an MCP security [document](https://github.com/cloudflare/agents/blob/main/docs/securing-mcp-servers.md) to achieve the same. ### Credits Disclosed responsibly by security researcher Peter Novotney. ### References - Fix Example: https://github.com/cloudflare/ai/pull/297
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
- Severity from
- GitHub (reviewed advisory)