CVE-2026-81888: @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Version 0.8.6 has a patch.
Other sources
Summary
The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage.
Details
The state check treated two absent values as a match, so a callback that omits state — and for which no state was ever stored — was allowed to redeem the authorization code. Hono's csrf() middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level GET navigation it treats as safe.
This affects the google, github, facebook, discord, twitch, linkedin, and msentra providers. The x (Twitter) provider is not exploitable due to its PKCE binding.
Impact
An attacker can make a victim's browser complete an OAuth callback that binds the attacker's identity instead of the victim's, leading to login CSRF (the victim silently acts inside the attacker's account) or forced account linking (the attacker's identity is linked to the victim's account, enabling later sign-in as the victim). Affects applications using an affected provider on @hono/oauth-providers 0.8.5 or earlier.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/@hono/oauth-providersto a version that resolves this vulnerability.Fixed in 0.8.6 - Upgrade
Upgrade
@hono/oauth-providersto a version that resolves this vulnerability.Fixed in 0.8.6 - Compensating control
If you cannot upgrade immediately, disable or remove usage of the affected built-in social login providers: google, github, facebook, discord, twitch, linkedin, and msentra (note: x (Twitter) is not exploitable due to its PKCE binding).
Event History
Frequently Asked Questions
Which deployments are exposed?
Applications using the built-in social login providers in @hono/oauth-providers before version 0.8.6 are affected. The issue occurs under default usage because a callback with no state value can pass the state check when state is absent on both sides.
What does an attacker need to exploit this?
The attack can be performed remotely without authentication, but requires user interaction. An attacker needs to cause a user to process a crafted OAuth callback that was not initiated by that user's genuine login attempt.
What is the remediation?
Upgrade @hono/oauth-providers to version 0.8.6, which includes the patch. The available data does not specify a workaround for deployments that cannot upgrade immediately.