CVE-2026-81888
CVE-2026-81888 · @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
CVSS 5.4 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
@hono/oauth-providers
- Versiones
- < 0.8.6: Afectada
Sin corrección publicada
@hono/oauth-providers npm
- Intervalos de versiones afectados
- SEMVER: < 0.8.6
Actualiza a 0.8.6
Fuentes originales
- https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q
- https://github.com/honojs/middleware/pull/2040
- https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1
- https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6
- https://nvd.nist.gov/vuln/detail/CVE-2026-81888