Honojs @hono/oauth-providers vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Honojs @hono/oauth-providers: 1 record(s), with affected versions and fixes.
CVE-2026-81888
Medium · 5.4
CWE-352 Aug 31, 2026
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.