Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-4120 State: PUBLISHED Published: 2025-04-30T14:00:05.715Z Last Updated: 2025-04-30T15:42:52.387Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: JWNR2000v2 Problem Types: CWE-120, CWE-119 Description: A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been classified as critical. Affected is the function sub_4238E8. The manipulation of the argument host leads to buffer overflow. It is possible to launch the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306600 - https://vuldb.com/?ctiid.306600
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306600 - https://vuldb.com/?ctiid.306600 - https://vuldb.com/?submit.560774 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Buffer_overflow-sub_4238E8-log_type/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4121 State: PUBLISHED Published: 2025-04-30T14:00:07.565Z Last Updated: 2025-04-30T15:43:26.903Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netgear Products: JWNR2000v2 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been declared as critical. Affected by this vulnerability is the function cmd_wireless. The manipulation of the argument host leads to command injection. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306601 - https://vuldb.co
ny way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306601 - https://vuldb.com/?ctiid.306601 - https://vuldb.com/?submit.560775 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Command_injection-cmd_wireless-port_phy_set/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4122 State: PUBLISHED Published: 2025-04-30T14:31:03.996Z Last Updated: 2025-04-30T15:03:09.629Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netgear Products: JWNR2000v2 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Netgear JWNR2000v2 1.0.0.11. It has been rated as critical. Affected by this issue is the function sub_435E04. The manipulation of the argument host leads to command injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306602 - https://vuldb.com/?ctiid.3066
ional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306602 - https://vuldb.com/?ctiid.306602 - https://vuldb.com/?submit.560776 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_JWNR2000v2/Command_injection-sub_435E04-auth_mac/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4123 State: PUBLISHED Published: 2025-05-22T07:44:09.491Z Last Updated: 2025-07-22T14:11:46.732Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: Grafana Products: Grafana Problem Types: CWE-79, CWE-601 Description: A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitrary JavaScript. This vulnerability does not require editor permissions and if anonymous access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the
s access is enabled, the XSS will work. If the Grafana Image Renderer plugin is installed, it is possible to exploit the open redirect to achieve a full read SSRF. The default Content-Security-Policy (CSP) in Grafana will block the XSS though the `connect-src` directive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://grafana.com/security/security-advisories/cve-2025-4123/ - https://grafana.com/blog/2025/05/23/grafana-security-release-medium-and-high-severity-security-fixes-for-cve-2025-4123-and-cve-2025-3580/
CVE ID: CVE-2025-4124 State: PUBLISHED Published: 2025-04-30T08:20:11.777Z Last Updated: 2025-04-30T13:04:14.791Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: ISPSoft Problem Types: CWE-787 Description: Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing ISP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00004_ISPSoft%20-%20Multiple%20Vulnerabilities_v2.pdf
CVE ID: CVE-2025-4125 State: PUBLISHED Published: 2025-04-30T08:21:22.470Z Last Updated: 2025-04-30T13:03:53.612Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: ISPSoft Problem Types: CWE-787 Description: Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsing ISP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://filecenter.deltaww.com/news/download/doc/Delta-PCSA-2025-00004_ISPSoft%20-%20Multiple%20Vulnerabilities_v2.pdf
CVE ID: CVE-2025-4126 State: PUBLISHED Published: 2025-05-15T03:21:39.238Z Last Updated: 2025-05-15T14:10:57.806Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: emmanuelg Products: EG-Series Problem Types: CWE-80 Description: The EG-Series plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [series] shortcode in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes in the shortcode_title function. This makes it possible for authenticated attackers - with contributor-level access and above, on sites with the Classic Editor plugin activated - to inject arb
d attackers - with contributor-level access and above, on sites with the Classic Editor plugin activated - to inject arbitrary JavaScript code in the titletag attribute that will execute whenever a user access an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab518a1b-304d-4b93-b807-65ef3941dd47?source=cve - https://plugins.trac.wordpress.org/browser/eg-series/trunk/lib/eg-plugin.inc.php#L546
CVE ID: CVE-2025-4127 State: PUBLISHED Published: 2025-05-08T06:39:50.774Z Last Updated: 2025-05-08T14:09:41.638Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: kcseopro Products: WP SEO Structured Data Schema Problem Types: CWE-79 Description: The WP SEO Structured Data Schema plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Price Range’ parameter in all versions up to, and including, 2.7.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts that will execute whenever an administrator accesses the p
butor-level access and above, to inject arbitrary web scripts that will execute whenever an administrator accesses the plugin settings page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/24f6c4e4-11c3-476f-9f50-42053b625ab8?source=cve - https://plugins.trac.wordpress.org/browser/wp-seo-structured-data-schema/trunk/lib/classes/KcSeoHelper.php#L7 - https://plugins.trac.wordpress.org/changeset/3289009/wp-seo-structured-data-schema
CVE ID: CVE-2025-4128 State: PUBLISHED Published: 2025-06-11T10:25:04.917Z Last Updated: 2025-06-11T13:12:40.338Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-863 Description: Mattermost versions 10.5.x <= 10.5.4, 9.11.x <= 9.11.13 fail to properly restrict API access to team information, allowing guest users to bypass permissions and view information about public teams they are not members of via a direct API call to /api/v4/teams/{team_id}. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates
CVE ID: CVE-2025-4129 State: PUBLISHED Published: 2025-07-21T13:59:38.421Z Last Updated: 2025-07-21T14:47:07.343Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PAVO Inc. Products: PAVO Pay Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers.This issue affects PAVO Pay: before 13.05.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0166
CVE ID: CVE-2025-4130 State: PUBLISHED Published: 2025-07-21T14:01:06.978Z Last Updated: 2025-07-21T14:46:39.226Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: PAVO Inc. Products: PAVO Pay Problem Types: CWE-798 Description: Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable.This issue affects PAVO Pay: before 13.05.2025. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-25-0166
CVE ID: CVE-2025-4131 State: PUBLISHED Published: 2025-05-02T01:43:34.850Z Last Updated: 2025-05-02T16:29:24.560Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: garubi Products: GmapsMania Problem Types: CWE-79 Description: The GmapsMania plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's gmap shortcode in all versions up to, and including, 1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Add
ess and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/30d39718-945a-43a2-be08-70be1af55965?source=cve - https://plugins.trac.wordpress.org/browser/gmapsmania/trunk/gmapsmania.php#L14
CVE ID: CVE-2025-4132 State: REJECTED Published: 2025-05-08T15:10:15.553Z Last Updated: 2025-05-12T08:42:57.361Z Description: No description available.
CVE ID: CVE-2025-4133 State: PUBLISHED Published: 2025-05-22T06:00:08.775Z Last Updated: 2025-05-22T13:24:12.606Z Vendors: Unknown Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 8.4.0 does not escape the title of posts when outputting them in a dashboard, which could allow users with the contributor role to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ebd7e5f5-af8d-42ca-b6ff-af92e03d4a3e/
CVE ID: CVE-2025-4134 State: PUBLISHED Published: 2025-05-28T13:53:26.499Z Last Updated: 2025-05-28T14:06:40.254Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Avast Products: Avast Business Antivirus Problem Types: CWE-552 Description: Lack of file validation in do_update_vps in Avast Business Antivirus for Linux 4.5 on Linux allows local user to spoof or tamper with the update file via an unverified file write. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.gendigital.com/us/en/contact-us/security-advisories/
CVE ID: CVE-2025-4135 State: PUBLISHED Published: 2025-04-30T17:31:04.131Z Last Updated: 2025-04-30T18:12:17.638Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Netgear Products: WG302v2 Problem Types: CWE-77, CWE-74 Description: A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulation of the argument host leads to command injection. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306626 - https://vuldb.com/?ctiid.306
tional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306626 - https://vuldb.com/?ctiid.306626 - https://vuldb.com/?submit.560779 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_WG302v2/Command_injection-basic_settings_handler-static-ip-update/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4136 State: PUBLISHED Published: 2025-04-30T19:31:06.079Z Last Updated: 2025-05-01T18:50:28.153Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: Weitong Products: Mall Problem Types: CWE-285, CWE-266 Description: A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulation of the argument ID leads to improper authorization. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306627 - https://vuldb.com/?ctiid.306627 - ht
nalyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306627 - https://vuldb.com/?ctiid.306627 - https://vuldb.com/?submit.560782 - https://www.cnblogs.com/aibot/p/18830909
CVE ID: CVE-2025-4138 State: PUBLISHED Published: 2025-06-03T12:59:02.717Z Last Updated: 2025-07-07T17:36:01.739Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Python Software Foundation Products: CPython Problem Types: CWE-22 Description: Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall() or TarFile.extract() using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://do
using the filter= parameter with a value of "data" or "tar". See the tarfile extraction filters documentation https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter for more information. Note that for Python 3.14 or later the default value of filter= changed from "no filtering" to `"data", so if you are relying on this new default behavior then your usage is also affected. Note that none of these vulnerabilities significantly affect the installation of source distributions which are tar archives as source distributions already allow arbitrary code execution during the build process. However when evaluating source distributions it's important to avoid installing source distr
n during the build process. However when evaluating source distributions it's important to avoid installing source distributions with suspicious links. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/python/cpython/issues/135034 - https://github.com/python/cpython/pull/135037 - https://mail.python.org/archives/list/security-announce@python.org/thread/MAXIJJCUUMCL7ATZNDVEGGHUMQMUUKLG/ - https://github.com/python/cpython/commit/3612d8f51741b11f36f8fb0494d79086bac9390a - https://github.com/python/cpython/commit/9e0ac76d96cf80b49055f6d6b9a6763fb9215c2a - https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f - https://github.com/python/cpython/co
3fb9215c2a - https://gist.github.com/sethmlarson/52398e33eff261329a0180ac1d54f42f - https://github.com/python/cpython/commit/19de092debb3d7e832e5672cc2f7b788d35951da - https://github.com/python/cpython/commit/aa9eb5f757ceff461e6e996f12c89e5d9b583b01 - https://github.com/python/cpython/commit/28463dba112af719df1e8b0391c46787ad756dd9 - https://github.com/python/cpython/commit/4633f3f497b1ff70e4a35b6fe2c907cbe2d4cb2e - https://github.com/python/cpython/commit/9c1110ef6652687d7c55f590f909720eddde965a - https://github.com/python/cpython/commit/dd8f187d0746da151e0025c51680979ac5b4cfb1
CVE ID: CVE-2025-4139 State: PUBLISHED Published: 2025-04-30T20:31:04.150Z Last Updated: 2025-04-30T20:35:31.481Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6120 Problem Types: CWE-120, CWE-119 Description: A vulnerability classified as critical was found in Netgear EX6120 1.0.0.68. Affected by this vulnerability is the function fwAcosCgiInbound. The manipulation of the argument host leads to buffer overflow. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306631 - https://vuldb.com/?ctiid.306631 -
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306631 - https://vuldb.com/?ctiid.306631 - https://vuldb.com/?submit.560785 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6120/Buffer_overflow-fwAcosCgiInbound-port_end/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4140 State: PUBLISHED Published: 2025-04-30T21:31:04.393Z Last Updated: 2025-05-02T16:50:49.517Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6120 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, has been found in Netgear EX6120 1.0.3.94. Affected by this issue is the function sub_30394. The manipulation of the argument host leads to buffer overflow. The attack may be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306632 - https://vuldb.com/?ctiid.306632
nal Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306632 - https://vuldb.com/?ctiid.306632 - https://vuldb.com/?submit.560788 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_30394-wifi_2g_onoff_sche/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4141 State: PUBLISHED Published: 2025-04-30T22:00:06.552Z Last Updated: 2025-05-01T15:33:55.055Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. This affects the function sub_3C03C. The manipulation of the argument host leads to buffer overflow. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306633 - https://vuldb.com/?ctiid.306633 - http
lyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306633 - https://vuldb.com/?ctiid.306633 - https://vuldb.com/?submit.560789 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_3C03C-bpa_server/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4142 State: PUBLISHED Published: 2025-04-30T22:31:04.284Z Last Updated: 2025-05-01T13:45:36.141Z Severity: N/A (CVSS 9 AV:N/AC:L/Au:S/C:C/I:C/A:C) Vendors: Netgear Products: EX6200 Problem Types: CWE-120, CWE-119 Description: A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. This vulnerability affects the function sub_3C8EC. The manipulation of the argument host leads to buffer overflow. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306634 - https://vuldb.com/?ctiid.306634 - htt
alyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.306634 - https://vuldb.com/?ctiid.306634 - https://vuldb.com/?submit.560790 - https://github.com/jylsec/vuldb/blob/main/Netgear/netgear_ex6200/Buffer_overflow-sub_3C8EC-gui_Wireless_Security_state/README.md - https://www.netgear.com/
CVE ID: CVE-2025-4143 State: PUBLISHED Published: 2025-05-01T00:19:52.737Z Last Updated: 2025-05-01T15:33:28.911Z Problem Types: CWE-601 Description: The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that redirect_uri was on the allowed list of redirect URIs for the given client registration. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/26 https://github.com/cloudflare/workers-oauth-provider/pull/26 Impact: Under certain circumstances (see below), if a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the v
a victim had previously authorized with a server built on workers-oath-provider, and an attacker could later trick the victim into visiting a malicious web site, then attacker could potentially steal the victim's credentials to the same OAuth server and subsequently impersonate them. In order for the attack to be possible, the OAuth server's authorized callback must be designed to auto-approve authorizations that appear to come from an OAuth client that the victim has authorized previously. The authorization flow is not implemented by workers-oauth-provider; it is up to the application built on top to decide whether to implement such automatic re-authorization. However, many applications do
application built on top to decide whether to implement such automatic re-authorization. However, many applications do implement such logic. Note: It is a basic, well-known requirement that OAuth servers should verify that the redirect URI is among the allowed list for the client, both during the authorization flow and subsequently when exchanging the authorization code for an access token. workers-oauth-provider implemented only the latter check, not the former. Unfortunately, the former is the much more important check. Readers who are familiar with OAuth may recognize that failing to check redirect URIs against the allowed list is a well-known, basic mistake, covered extensively in the R
hat failing to check redirect URIs against the allowed list is a well-known, basic mistake, covered extensively in the RFC and elsewhere. The author of this library would like everyone to know that he was, in fact, well-aware of this requirement, thought about it a lot while designing the library, and then, somehow, forgot to actually make sure the check was in the code. That is, it's not that he didn't know what he was doing, it's that he knew what he was doing but flubbed it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/workers-oauth-provider/pull/26
CVE ID: CVE-2025-4144 State: PUBLISHED Published: 2025-05-01T00:50:27.543Z Last Updated: 2025-05-01T15:33:23.092Z Problem Types: CWE-287 Description: PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However, it was found that an attacker could cause the check to be skipped. Fixed in: https://github.com/cloudflare/workers-oauth-provider/pull/27 https://github.com/cloudflare/workers-oauth-provider/pull/27 Impact: PKCE is a defense-in-depth mechanism against certain kinds of attacks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specifi
acks and was an optional extension in OAuth 2.0 which became required in the OAuth 2.1 draft. (Note that the MCP specification requires OAuth 2.1.). This bug completely bypasses PKCE protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/workers-oauth-provider/pull/27