GHSA-FM3F-CH8H-QW8Q
Vulnerability from github – Published: 2026-08-31 20:30 – Updated: 2026-08-31 20:30Summary
The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage.
Details
The state check treated two absent values as a match, so a callback that omits state — and for which no state was ever stored — was allowed to redeem the authorization code. Hono's csrf() middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level GET navigation it treats as safe.
This affects the google, github, facebook, discord, twitch, linkedin, and msentra providers. The x (Twitter) provider is not exploitable due to its PKCE binding.
Impact
An attacker can make a victim's browser complete an OAuth callback that binds the attacker's identity instead of the victim's, leading to login CSRF (the victim silently acts inside the attacker's account) or forced account linking (the attacker's identity is linked to the victim's account, enabling later sign-in as the victim). Affects applications using an affected provider on @hono/oauth-providers 0.8.5 or earlier.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@hono/oauth-providers"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.8.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-81888"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-1275"
],
"github_reviewed": true,
"github_reviewed_at": "2026-08-31T20:30:50Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nThe built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage.\n\n### Details\n\nThe `state` check treated two absent values as a match, so a callback that omits `state` \u2014 and for which no `state` was ever stored \u2014 was allowed to redeem the authorization code. Hono\u0027s `csrf()` middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level `GET` navigation it treats as safe.\n\nThis affects the `google`, `github`, `facebook`, `discord`, `twitch`, `linkedin`, and `msentra` providers. The `x` (Twitter) provider is not exploitable due to its PKCE binding.\n\n### Impact\n\nAn attacker can make a victim\u0027s browser complete an OAuth callback that binds the attacker\u0027s identity instead of the victim\u0027s, leading to login CSRF (the victim silently acts inside the attacker\u0027s account) or forced account linking (the attacker\u0027s identity is linked to the victim\u0027s account, enabling later sign-in as the victim). Affects applications using an affected provider on `@hono/oauth-providers` `0.8.5` or earlier.",
"id": "GHSA-fm3f-ch8h-qw8q",
"modified": "2026-08-31T20:30:50Z",
"published": "2026-08-31T20:30:50Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q"
},
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/pull/2040"
},
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1"
},
{
"type": "PACKAGE",
"url": "https://github.com/honojs/middleware"
},
{
"type": "WEB",
"url": "https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.