{"id":"CVE-2026-81888","summary":"@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking","details":"@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.","aliases":["GHSA-fm3f-ch8h-qw8q"],"modified":"2026-10-28T02:30:41.758261601Z","published":"2026-08-31T20:27:33.165Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1275","CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81888.json"},"references":[{"type":"WEB","url":"https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81888.json"},{"type":"ADVISORY","url":"https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81888"},{"type":"FIX","url":"https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1"},{"type":"FIX","url":"https://github.com/honojs/middleware/pull/2040"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/honojs/middleware","events":[{"introduced":"0"},{"fixed":"a43558b2d60b594b7370eac3fe8811ad66c6de7c"},{"fixed":"b37765f40b7bddb1d8fce39573b085222dea58c1"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"0.8.6"}]},{"range":[{"fixed":"b37765f40b7bddb1d8fce39573b085222dea58c1"}],"source":"REFERENCES_COMMIT"}]}}],"versions":["@hono/zod-openapi@0.8.5","@hono/zod-openapi@0.8.4","@hono/medley-router@0.0.3","@hono/firebase-auth@1.3.3","@hono/esbuild-transpiler@0.1.2","@hono/esbuild-transpiler@0.1.1","@hono/hello@0.1.1","@hono/esbuild-transpiler@0.1.0","@hono/swagger-ui@0.1.0","@hono/hello@0.1.0","@hono/zod-openapi@0.8.3","@hono/zod-openapi@0.8.2","@hono/valibot-validator@0.2.1","@hono/typia-validator@0.0.3","@hono/typebox-validator@0.2.2","@hono/zod-validator@0.1.11","@hono/clerk-auth@1.0.0","@hono/zod-openapi@0.8.1","@hono/zod-validator@0.1.10","@hono/zod-openapi@0.8.0","@hono/graphql-server@0.4.1","@hono/firebase-auth@1.3.2","@hono/firebase-auth@1.3.1","@hono/zod-openapi@0.7.2","@hono/zod-openapi@0.7.1","@hono/typebox-validator@0.2.1","@hono/zod-validator@0.1.9","@hono/zod-openapi@0.7.0","@hono/zod-openapi@0.6.0","@hono/zod-openapi@0.5.1","@hono/zod-openapi@0.5.0","@hono/typia-validator@0.0.2","@hono/zod-openapi@0.4.0","@hono/zod-openapi@0.3.1","@hono/zod-openapi@0.3.0","@hono/zod-openapi@0.2.0","@hono/zod-openapi@0.1.2","@hono/sentry@1.0.0","@hono/valibot-validator@0.2.0","@hono/zod-openapi@0.1.1","@hono/sentry@0.2.2","@hono/qwik-city@0.0.4","@hono/zod-openapi@0.1.0","@hono/zod-openapi@0.0.1","@hono/zod-validator@0.1.8","@hono/zod-validator@0.1.7","@hono/zod-validator@0.1.6","@hono/valibot-validator@0.1.2","@hono/zod-validator@0.1.5","@hono/zod-validator@0.1.4","@hono/valibot-validator@0.1.1","@hono/valibot-validator@0.1.0","@hono/typebox-validator@0.2.0","@hono/qwik-city@0.0.3","@hono/medley-router@0.0.2","@hono/zod-validator@0.1.3","@hono/sentry@0.2.1","@hono/medley-router@0.0.1","@hono/qwik-city@0.0.2","@hono/zod-validator@0.1.2","@hono/typebox-validator@0.1.1","@hono/firebase-auth@1.3.0","@hono/zod-validator@0.1.1","@hono/typebox-validator@0.1.0","@hono/zod-validator@0.1.0","@hono/firebase-auth@1.2.0","@hono/sentry@0.2.0","@hono/typebox-validator@0.0.1","@hono/graphql-server@0.4.0","@hono/trpc-server@0.1.0","@hono/zod-validator@0.0.6","@hono/zod-validator@0.0.5","@hono/hello@0.0.15","@hono/trpc-server@0.0.2","@hono/zod-validator@0.0.4","@hono/trpc-server@0.0.1","@hono/firebase-auth@1.1.0","@hono/sentry@0.1.0","@hono/sentry@0.0.6","v0.0.6","@hono/graphql-server@0.2.0","@hono/zod-validator@0.0.3","@hono/zod-validator@0.0.2","@hono/qwik-city@0.0.1","@hono/hello@0.0.14","@hono/zod-validator@0.0.1","@hono/hello@0.0.13","@hono/hello@0.0.11","@hono/hello@0.0.8","@honojs/trpc-adapter@0.0.0","@honojs/hello@0.0.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81888.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}