{"id":"CVE-2026-81888","summary":"@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking","details":"@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.","aliases":["GHSA-fm3f-ch8h-qw8q"],"modified":"2026-09-11T03:30:59.992305744Z","published":"2026-08-31T20:27:33.165Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1275","CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81888.json"},"references":[{"type":"WEB","url":"https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81888.json"},{"type":"ADVISORY","url":"https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-81888"},{"type":"FIX","url":"https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1"},{"type":"FIX","url":"https://github.com/honojs/middleware/pull/2040"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/honojs/middleware","events":[{"introduced":"0"},{"fixed":"b37765f40b7bddb1d8fce39573b085222dea58c1"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"0"},{"fixed":"0.8.6"}]}}],"versions":["@hono/zod-validator@0.9.0","@hono/zod-openapi@1.5.1","@hono/standard-validator@0.3.0","@hono/zod-openapi@1.5.0","@hono/eslint-config@2.1.1","@hono/oidc-auth@1.9.0","@hono/ua-blocker@0.1.35","@hono/mcp@0.3.1","@hono/standard-validator@0.2.3","@hono/ua-blocker@0.1.34","@hono/ua-blocker@0.1.33","@hono/inertia@0.7.0","@hono/ua-blocker@0.1.32","@hono/typia-validator@0.1.3","@hono/inertia@0.6.0","@hono/inertia@0.5.0","@hono/session@0.2.1","@hono/ua-blocker@0.1.31","@hono/inertia@0.4.0","@hono/oidc-auth@1.8.3","@hono/inertia@0.3.0","@hono/ua-blocker@0.1.30","@hono/mcp@0.3.0","@hono/ua-blocker@0.1.29","@hono/zod-validator@0.8.0","@hono/zod-openapi@1.4.0","@hono/otel@1.1.2","@hono/ua-blocker@0.1.28","@hono/node-ws@1.3.1","@hono/oidc-auth@1.8.2","@hono/inertia@0.2.0","@hono/structured-logger@0.1.0","@hono/prometheus@1.0.3","@hono/zod-openapi@1.3.0","@hono/cloudflare-access@0.4.0","@hono/clerk-auth@3.1.1","@hono/mcp@0.2.5","@hono/zod-openapi@1.2.4","@hono/ua-blocker@0.1.27","@hono/ua-blocker@0.1.26","@hono/bun-compress@0.1.1","@hono/zod-openapi@1.2.3","@hono/swagger-ui@0.6.1","@hono/ua-blocker@0.1.25","@hono/otel@1.1.1","@hono/swagger-ui@0.6.0","@hono/eslint-config@2.1.0","@hono/mcp@0.2.4","@hono/oidc-auth@1.8.1","@hono/zod-openapi@1.2.2","@hono/auth-js@1.1.1","@hono/ua-blocker@0.1.24","@hono/zod-openapi@1.2.1","@hono/eslint-config@2.0.6","@hono/oidc-auth@1.8.0","@hono/clerk-auth@3.1.0","@hono/standard-validator@0.2.2","@hono/trpc-server@0.4.2","@hono/eslint-config@2.0.5","@hono/node-ws@1.3.0","@hono/eslint-config@2.0.4","@hono/swagger-ui@0.5.3","@hono/mcp@0.2.3","@hono/otel@1.1.0","@hono/ua-blocker@0.1.23","@hono/zod-openapi@1.2.0","@hono/zod-openapi@1.1.6","@hono/zod-validator@0.7.6","@hono/ua-blocker@0.1.22","@hono/valibot-validator@0.6.1","@hono/standard-validator@0.2.1","@hono/typedriver-validator@0.1.0","@hono/mcp@0.2.2","@hono/ua-blocker@0.1.21","@hono/trpc-server@0.4.1","@hono/mcp@0.2.1","@hono/capnweb@0.1.0","@hono/ua-blocker@0.1.20","@hono/ua-blocker@0.1.19","@hono/mcp@0.2.0","@hono/ua-blocker@0.1.18","@hono/zod-validator@0.7.5","@hono/zod-openapi@1.1.5","@hono/valibot-validator@0.6.0","@hono/standard-validator@0.2.0","@hono/ua-blocker@0.1.17","@hono/ua-blocker@0.1.16","@hono/hello@0.1.3","@hono/otel@1.0.1","@hono/mcp@0.1.5","@hono/ua-blocker@0.1.15","@hono/otel@1.0.0","@hono/ua-blocker@0.1.14","@hono/typebox-validator@1.1.0","@hono/zod-openapi@1.1.4","@hono/ajv-validator@0.0.2","@hono/ua-blocker@0.1.13","@hono/otel@0.6.0","@hono/typebox-validator@1.0.0","@hono/zod-validator@0.7.4","@hono/oidc-auth@1.7.1","@hono/ua-blocker@0.1.12","@hono/zod-openapi@1.1.3","@hono/zod-openapi@1.1.2","@hono/zod-validator@0.7.3","@hono/zod-openapi@1.1.1","@hono/ua-blocker@0.1.11","@hono/graphql-server@0.7.0","@hono/ua-blocker@0.1.10","@hono/mcp@0.1.4","@hono/mcp@0.1.3","@hono/ua-blocker@0.1.9","@hono/mcp@0.1.2","@hono/oauth-providers@0.8.5","@hono/standard-validator@0.1.5","@hono/otel@0.5.0","@hono/ua-blocker@0.1.8","@hono/oauth-providers@0.8.4","@hono/ssg-plugins-essential@0.1.0","@hono/oauth-providers@0.8.3","@hono/otel@0.4.0","@hono/zod-openapi@1.1.0","@hono/clerk-auth@3.0.3","@hono/eslint-config@2.0.3","@hono/ua-blocker@0.1.7","@hono/mcp@0.1.1","@hono/otel@0.3.0","@hono/auth-js@1.1.0","@hono/standard-validator@0.1.4","@hono/zod-openapi@1.0.2","@hono/zod-validator@0.7.2","@hono/zod-openapi@1.0.1","@hono/zod-openapi@1.0.0","@hono/ua-blocker@0.1.6","@hono/zod-validator@0.7.1","@hono/zod-openapi@0.19.10","@hono/session@0.2.0","@hono/session@0.1.1","@hono/ua-blocker@0.1.5","@hono/clerk-auth@3.0.2","@hono/standard-validator@0.1.3","@hono/valibot-validator@0.5.3","@hono/ua-blocker@0.1.4","@hono/ua-blocker@0.1.3","@hono/zod-openapi@0.19.9","@hono/stytch-auth@0.1.1","@hono/session@0.1.0","@hono/clerk-auth@3.0.1","@hono/oidc-auth@1.7.0","@hono/react-compat@0.0.3","@hono/react-compat@0.0.2","@hono/oauth-providers@0.8.2","@hono/eslint-config@2.0.2","@hono/graphql-server@0.6.2","@hono/node-ws@1.2.0","@hono/trpc-server@0.4.0","@hono/ua-blocker@0.1.2","@hono/clerk-auth@3.0.0","@hono/mcp@0.1.0","@hono/ua-blocker@0.1.1","@hono/ua-blocker@0.1.0","@hono/stytch-auth@0.1.0","@hono/auth-js@1.0.17","@hono/swagger-ui@0.5.2","@hono/swagger-editor@1.0.1","@hono/sentry@1.2.2","@hono/prometheus@1.0.2","@hono/otel@0.2.2","@hono/oidc-auth@1.6.1","@hono/oauth-providers@0.8.1","@hono/node-ws@1.1.7","@hono/medley-router@0.0.4","@hono/hello@0.1.2","@hono/graphql-server@0.6.1","@hono/esbuild-transpiler@0.1.4","@hono/cloudflare-access@0.3.1","@hono/clerk-auth@2.0.1","@hono/bun-transpiler@0.2.1","@hono/otel@0.2.1","@hono/node-ws@1.1.6","@hono/node-ws@1.1.5","@hono/zod-validator@0.7.0","@hono/zod-openapi@0.19.8","@hono/zod-validator@0.6.0","@hono/zod-openapi@0.19.7","@hono/auth-js@1.0.16","@hono/oauth-providers@0.8.0","@hono/zod-validator@0.5.0","@hono/zod-openapi@0.19.6","@hono/react-renderer@1.0.1","@hono/otel@0.2.0","@hono/node-ws@1.1.4","@hono/graphql-server@0.6.0","@hono/eslint-config@2.0.1","@hono/bun-compress@0.1.0","@hono/arktype-validator@2.0.1","@hono/eslint-config@2.0.0","@hono/zod-openapi@0.19.3","@hono/oauth-providers@0.7.1","@hono/node-ws@1.1.1","@hono/eslint-config@1.1.1","@hono/typebox-validator@0.3.3","@hono/sentry@1.2.1","@hono/eslint-config@1.1.0","@hono/oidc-auth@1.6.0","@hono/typia-validator@0.1.2","@hono/typia-validator@0.1.1","@hono/oidc-auth@1.5.0","@hono/oauth-providers@0.7.0","@hono/otel@0.1.0","@hono/cloudflare-access@0.3.0","@hono/zod-openapi@0.19.2","@hono/zod-openapi@0.19.1","@hono/swagger-ui@0.5.1","@hono/zod-openapi@0.19.0","@hono/node-ws@1.1.0","@hono/react-renderer@0.3.0","@hono/zod-validator@0.4.3","@hono/standard-validator@0.1.2","@hono/node-ws@1.0.8","@hono/standard-validator@0.1.1","@hono/standard-validator@0.1.0","@hono/zod-openapi@0.18.4","@hono/node-ws@1.0.7","@hono/typebox-validator@0.3.2","@hono/typebox-validator@0.3.1","@hono/node-ws@1.0.6","@hono/oidc-auth@1.4.1","@hono/oidc-auth@1.4.0","@hono/valibot-validator@0.5.2","@hono/oidc-auth@1.3.0","@hono/firebase-auth@1.4.2","@hono/cloudflare-access@0.2.0","@hono/typia-validator@0.1.0","@hono/cloudflare-access@0.1.0","@hono/zod-validator@0.4.2","@hono/node-ws@1.0.5","@hono/typebox-validator@0.3.0","@hono/trpc-server@0.3.4","@hono/effect-validator@1.2.0","@hono/trpc-server@0.3.3","@hono/zod-openapi@0.18.3","@hono/zod-openapi@0.18.2","@hono/zod-openapi@0.18.1","@hono/swagger-ui@0.5.0","@hono/zod-openapi@0.18.0","@hono/tsyringe@1.0.1","@hono/tsyringe@1.0.0","@hono/zod-openapi@0.17.1","@hono/ajv-validator@0.0.1","@hono/valibot-validator@0.5.1","@hono/typebox-validator@0.2.6","@hono/valibot-validator@0.5.0","@hono/class-validator@1.0.0","@hono/auth-js@1.0.15","@hono/zod-openapi@0.17.0","@hono/auth-js@1.0.14","@hono/swagger-editor@1.0.0","@hono/valibot-validator@0.4.1","@hono/oidc-auth@1.2.0","@hono/auth-js@1.0.13","@hono/auth-js@1.0.12","@hono/oauth-providers@0.6.2","@hono/auth-js@1.0.11","@hono/valibot-validator@0.4.0","@hono/zod-validator@0.4.1","@hono/zod-openapi@0.16.4","@hono/zod-openapi@0.16.3","@hono/effect-validator@1.1.0","@hono/valibot-validator@0.3.1","@hono/zod-openapi@0.16.2","@hono/zod-validator@0.3.0","@hono/zod-openapi@0.16.1","@hono/eslint-config@1.0.2","@hono/typebox-validator@0.2.5","@hono/casbin@1.0.0","@hono/eslint-config@1.0.1","@hono/eslint-config@1.0.0","@hono/oidc-auth@1.1.0","@hono/zod-openapi@0.16.0","@hono/swagger-ui@0.4.1","@hono/graphql-server@0.5.1","@hono/oauth-providers@0.6.1","@hono/zod-openapi@0.15.3","@hono/zod-openapi@0.15.2","@hono/event-emitter@2.0.0","@hono/react-renderer@0.2.1","@hono/conform-validator@1.0.0","@hono/graphql-server@0.5.0","@hono/graphql-server@0.4.4","@hono/zod-openapi@0.15.1","@hono/effect-validator@1.0.1","@hono/oauth-providers@0.6.0","@hono/node-ws@1.0.4","@hono/zod-openapi@0.15.0","@hono/node-ws@1.0.3","@hono/effect-validator@1.0.0","@hono/zod-openapi@0.14.9","@hono/swagger-ui@0.4.0","@hono/event-emitter@1.0.0","@hono/zod-openapi@0.14.8","@hono/sentry@1.2.0","@hono/node-ws@1.0.2","@hono/auth-js@1.0.10","@hono/zod-openapi@0.14.7","@hono/zod-openapi@0.14.6","@hono/trpc-server@0.3.2","@hono/auth-js@1.0.9","@hono/oauth-providers@0.5.1","@hono/swagger-ui@0.3.0","@hono/zod-openapi@0.14.5","@hono/zod-openapi@0.14.4","@hono/zod-openapi@0.14.3","@hono/typia-validator@0.0.5","@hono/react-compat@0.0.1","@hono/valibot-validator@0.3.0","@hono/zod-openapi@0.14.2","@hono/zod-validator@0.2.2","@hono/zod-openapi@0.14.1","@hono/auth-js@1.0.8","@hono/node-ws@1.0.1","@hono/eslint-config@0.0.6","@hono/eslint-config@0.0.5","@hono/arktype-validator@2.0.0","@hono/zod-openapi@0.14.0","@hono/zod-openapi@0.13.0","@hono/zod-openapi@0.12.2","@hono/trpc-server@0.3.1","@hono/zod-openapi@0.12.1","@hono/zod-openapi@0.12.0","@hono/valibot-validator@0.2.5","@hono/zod-openapi@0.11.1","@hono/node-ws@1.0.0","@hono/oauth-providers@0.5.0","@hono/valibot-validator@0.2.4","@hono/sentry@1.1.0","@hono/auth-js@1.0.7","@hono/typia-validator@0.0.4","@hono/typebox-validator@0.2.4","@hono/swagger-ui@0.2.2","@hono/auth-js@1.0.6","@hono/auth-js@1.0.5","@hono/trpc-server@0.3.0","@hono/trpc-server@0.2.0","@hono/auth-js@1.0.4","@hono/prometheus@1.0.1","@hono/clerk-auth@2.0.0","@hono/oauth-providers@0.4.0","@hono/valibot-validator@0.2.3","@hono/typebox-validator@0.2.3","@hono/clerk-auth@1.0.3","@hono/clerk-auth@1.0.2","@hono/firebase-auth@1.4.1","@hono/react-renderer@0.2.0","@hono/esbuild-transpiler@0.1.3","@hono/zod-openapi@0.11.0","@hono/zod-openapi@0.10.1","@hono/zod-openapi@0.10.0","@hono/zod-openapi@0.9.10","@hono/zod-validator@0.2.1","@hono/zod-openapi@0.9.9","@hono/oauth-providers@0.3.2","@hono/react-renderer@0.1.1","@hono/react-renderer@0.1.0","@hono/zod-validator@0.2.0","@hono/zod-openapi@0.9.8","@hono/zod-openapi@0.9.7","@hono/firebase-auth@1.4.0","@hono/oauth-providers@0.3.1","@hono/firebase-auth@1.3.6","@hono/valibot-validator@0.2.2","@hono/graphql-server@0.4.3","@hono/sentry@1.0.1","@hono/oidc-auth@1.0.1","@hono/oidc-auth@1.0.0","@hono/trpc-server@0.1.1","@hono/firebase-auth@1.3.5","@hono/clerk-auth@1.0.1","@hono/auth-js@1.0.3","@hono/eslint-config@0.0.4","@hono/graphql-server@0.4.2","@hono/auth-js@1.0.2","@hono/prometheus@1.0.0","@hono/zod-openapi@0.9.6","@hono/bun-transpiler@0.2.0","@hono/bun-transpiler@0.1.0","@hono/oauth-providers@0.3.0","@hono/arktype-validator@1.0.0","@hono/firebase-auth@1.3.4","@hono/swagger-ui@0.2.1","@hono/auth-js@1.0.1","@hono/qwik-city@0.0.5","@hono/auth-js@1.0.0","@hono/react-renderer@0.0.2","@hono/zod-openapi@0.9.5","@hono/zod-openapi@0.9.4","@hono/react-renderer@0.0.1","@hono/eslint-config@0.0.3","@hono/eslint-config@0.0.2","@hono/eslint-config@0.0.1","@hono/oauth-providers@0.2.0","@hono/zod-openapi@0.9.3","@hono/zod-openapi@0.9.2","@hono/zod-openapi@0.9.1","@hono/oauth-providers@0.1.2","@hono/zod-openapi@0.9.0","@hono/oauth-providers@0.1.1","@hono/swagger-ui@0.2.0","@hono/oauth-providers@0.1.0","@hono/zod-openapi@0.8.6","@hono/zod-openapi@0.8.5","@hono/zod-openapi@0.8.4","@hono/medley-router@0.0.3","@hono/firebase-auth@1.3.3","@hono/esbuild-transpiler@0.1.2","@hono/esbuild-transpiler@0.1.1","@hono/hello@0.1.1","@hono/esbuild-transpiler@0.1.0","@hono/swagger-ui@0.1.0","@hono/hello@0.1.0","@hono/zod-openapi@0.8.3","@hono/zod-openapi@0.8.2","@hono/valibot-validator@0.2.1","@hono/typia-validator@0.0.3","@hono/typebox-validator@0.2.2","@hono/zod-validator@0.1.11","@hono/clerk-auth@1.0.0","@hono/zod-openapi@0.8.1","@hono/zod-validator@0.1.10","@hono/zod-openapi@0.8.0","@hono/graphql-server@0.4.1","@hono/firebase-auth@1.3.2","@hono/firebase-auth@1.3.1","@hono/zod-openapi@0.7.2","@hono/zod-openapi@0.7.1","@hono/typebox-validator@0.2.1","@hono/zod-validator@0.1.9","@hono/zod-openapi@0.7.0","@hono/zod-openapi@0.6.0","@hono/zod-openapi@0.5.1","@hono/zod-openapi@0.5.0","@hono/typia-validator@0.0.2","@hono/zod-openapi@0.4.0","@hono/zod-openapi@0.3.1","@hono/zod-openapi@0.3.0","@hono/zod-openapi@0.2.0","@hono/zod-openapi@0.1.2","@hono/sentry@1.0.0","@hono/valibot-validator@0.2.0","@hono/zod-openapi@0.1.1","@hono/sentry@0.2.2","@hono/qwik-city@0.0.4","@hono/zod-openapi@0.1.0","@hono/zod-openapi@0.0.1","@hono/zod-validator@0.1.8","@hono/zod-validator@0.1.7","@hono/zod-validator@0.1.6","@hono/valibot-validator@0.1.2","@hono/zod-validator@0.1.5","@hono/zod-validator@0.1.4","@hono/valibot-validator@0.1.1","@hono/valibot-validator@0.1.0","@hono/typebox-validator@0.2.0","@hono/qwik-city@0.0.3","@hono/medley-router@0.0.2","@hono/zod-validator@0.1.3","@hono/sentry@0.2.1","@hono/medley-router@0.0.1","@hono/qwik-city@0.0.2","@hono/zod-validator@0.1.2","@hono/typebox-validator@0.1.1","@hono/firebase-auth@1.3.0","@hono/zod-validator@0.1.1","@hono/typebox-validator@0.1.0","@hono/zod-validator@0.1.0","@hono/firebase-auth@1.2.0","@hono/sentry@0.2.0","@hono/typebox-validator@0.0.1","@hono/graphql-server@0.4.0","@hono/trpc-server@0.1.0","@hono/zod-validator@0.0.6","@hono/zod-validator@0.0.5","@hono/hello@0.0.15","@hono/trpc-server@0.0.2","@hono/zod-validator@0.0.4","@hono/trpc-server@0.0.1","@hono/firebase-auth@1.1.0","@hono/sentry@0.1.0","@hono/sentry@0.0.6","v0.0.6","@hono/graphql-server@0.2.0","@hono/zod-validator@0.0.3","@hono/zod-validator@0.0.2","@hono/qwik-city@0.0.1","@hono/hello@0.0.14","@hono/zod-validator@0.0.1","@hono/hello@0.0.13","@hono/hello@0.0.11","@hono/hello@0.0.8","@honojs/trpc-adapter@0.0.0","@honojs/hello@0.0.7"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81888.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"}]}