Missing validation of redirect_uri on OAuth callback handler
Medium4.8Published Nov 4, 2025
### Description A vulnerability exists in the MCP server's OAuth implementation of our MCP demo applications, where the redirect_uri parameter, encoded within the state parameter, is not properly validated. The OAuth callback handler in the affected library fails to verify that the redirect_uri parameter received during the authorization callback matches the redirect_uri originally specified in the authorization request. This flaw allows an attacker to manipulate the redirect_uri to a malicious destination. Because the MCP server automatically approves new authorizations without requiring user interaction, successful exploitation can lead to account takeover and unauthorized access to the victim's MCP server resources. ### Impact An attacker who can cause a user to follow a crafted OAuth flow may obtain enough information to exchange the authorization code and perform actions against the service in the victim’s context. ### Mitigation Users are requested to upgrade to version SHA f7c11c87ef48e9fd898b9d1ebea75078b7279728 or later of the demos. We also recommend proper implementation of CSRF Tokens in the client application as shown in [https://github.com/cloudflare/ai/pull/297](h...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| ai Product | < upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728orlater | upgradetoversionSHAf7c11c87ef48e9fd898b9d1ebea75078b7279728orlater |
Details and references
### Description A vulnerability exists in the MCP server's OAuth implementation of our MCP demo applications, where the redirect_uri parameter, encoded within the state parameter, is not properly validated. The OAuth callback handler in the affected library fails to verify that the redirect_uri parameter received during the authorization callback matches the redirect_uri originally specified in the authorization request. This flaw allows an attacker to manipulate the redirect_uri to a malicious destination. Because the MCP server automatically approves new authorizations without requiring user interaction, successful exploitation can lead to account takeover and unauthorized access to the victim's MCP server resources. ### Impact An attacker who can cause a user to follow a crafted OAuth flow may obtain enough information to exchange the authorization code and perform actions against the service in the victim’s context. ### Mitigation Users are requested to upgrade to version SHA f7c11c87ef48e9fd898b9d1ebea75078b7279728 or later of the demos. We also recommend proper implementation of CSRF Tokens in the client application as shown in [https://github.com/cloudflare/ai/pull/297](https://github.com/cloudflare/ai/pull/297). For users who prefer using a coding agent, we have provided an MCP security [document](https://github.com/cloudflare/agents/blob/main/docs/securing-mcp-servers.md) to achieve the same. ### Credits Disclosed responsibly by security researcher Peter Novotney. ### References - Fix Example: https://github.com/cloudflare/ai/pull/297
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
- Severity from
- GitHub (reviewed advisory)
More Cloudflare advisories
All Cloudflare| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 5 | HTTP Request Smuggling via Premature Upgrade | Critical9.3 | 0.8.0 |
| Feb 24 | Incorrect calculation in circl secp384r1 CombinedMult | Low | 1.6.3 |
| Jan 21 | OS Command Injection in `wrangler pages deploy` | High7.7 | 4.59.1 |
| Sep 172025 | Pingora update for MadeYouReset HTTP/2 vulnerability | High8.2 | 0.6.0 |
| Aug 72025 | Infinite loop triggered by connection ID retirement | High8.7 | 0.24.5 |
| Jul 72025 | Cloudflare vite plugin exposes secrets over the built-in dev server | Low | 1.6.0 |