Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M

CVE-2026-81888@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Medium 5.4

In plain English

A medium-severity cross-site request forgery in @hono/oauth-providers from honojs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 91.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@hono/oauth-providers	0.8.6	GHSA-fm3f-ch8h-qw8q

Affected products (as reported)

Vendor	Product	Versions
honojs	@hono/oauth-providers	< 0.8.6

Weakness: CWE-352, CWE-1275 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q x_refsource_CONFIRM
https://github.com/honojs/middleware/pull/2040 x_refsource_MISC
https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1 x_refsource_MISC
https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6 x_refsource_MISC