CVE-2026-81888— @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
Quick assessment
Affected
honojs @hono/oauth-providers
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
是 Hono 的认证中间件。在 0.8.6 版本之前，内置的社交登录提供者即使双方都缺失 值，也会接受 OAuth 回调，导致防 CSRF 检查通过了一个并非来自真实登录尝试的回调。在默认使用场景下，这使得基于 的 CSRF 保护失效。0.8.6 版本已提供补丁修复此问题。
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-Middle
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81888
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
Source: CVE Program / CVE List V5
Vulnerability Description
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
跨站请求伪造(CSRF)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| honojs | @hono/oauth-providers | < 0.8.6 | - |
|
II. Public POCs for CVE-2026-81888
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81888
请登录查看更多情报信息。
Other References for CVE-2026-81888 (4)
-
-
-
🔗 Release @hono/oauth-providers@0.8.6 · honojs/middleware · GitHub x_refsource_MISC
-
IV. Related Vulnerabilities
Same vendor: honojs
-
CVE-2026-73565
@hono/node-server: Unauthenticated memory-leak DoS via abort -
CVE-2026-69207
Hono: ReDoS in CORS middleware via Access-Control-Request-He -
CVE-2026-71850
Hono: `memo()` retains SSR output across requests, leading t -
CVE-2026-71849
Hono: Proxy Helper does not remove response headers listed i -
CVE-2026-71848
Hono: Algorithmic Complexity DoS in Language Middleware
Same weakness: CWE-352
-
CVE-2026-54599
Wallos: OIDC state parameter never validated — login CSRF / -
CVE-2026-81890
elFinder: CSRF in netmount allows forced FTP mounts and serv -
CVE-2026-71378
Apache Wicket: Cross-Site Request Forgery (CSRF) protection -
CVE-2026-82647
WWBN AVideo Cross-Site Request Forgery via sendEmail.json.ph -
CVE-2026-82544
wger-project wger Password Reset gym.py reset_user_password
V. Comments for CVE-2026-81888
No comments yet