MEDIUMCVSS 5.4Vulnerability
CVE-2026-81888
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
Properties
- summary
- @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
- severity
- MEDIUM
- cvss_severity
- MEDIUM
- epss_score
- 0.00191
- cvss_score
- 5.4
- retrieved_at
- 2026-10-14T17:11:50+00:00
- ghsa_published
- 2026-08-31T20:30:50Z
- source_url
- https://github.com/advisories/GHSA-fm3f-ch8h-qw8q
- ghsa_updated
- 2026-08-31T20:30:51Z
- ghsa_id
- GHSA-fm3f-ch8h-qw8q
- last_source
- FIRST EPSS
- score
- 5.4
- cve_id
- CVE-2026-81888
- cvss_vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- published_at
- 2026-08-31T21:17:52.317
- last_modified
- 2026-09-09T21:09:13.080
- epss_percentile
- 0.08211
Related Entities (7)
DESCRIBED_BY (1)
→[Source]NVD
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]npm/@hono/oauth-providers
AFFECTS (1)
→[Software]npm/@hono/oauth-providers
HAS_WEAKNESS (2)
→[Weakness]Sensitive Cookie with Improper SameSite Attribute
→[Weakness]Cross-Site Request Forgery (CSRF)
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph