OAuth Callback CSRF Bypass in Hono OAuth Providers

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-81888

Affected Vendors & Products

Vendor	Product	Version / Range
hono	oauth_providers	to 0.8.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1275	The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
CWE-352	The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the @hono/oauth-providers library before version 0.8.6. The issue is that social login providers accept an OAuth callback even when the state parameter is missing, bypassing CSRF protection. Normally, the state parameter ensures the callback originates from a legitimate login attempt.

Impact Analysis

An attacker could exploit this to perform CSRF attacks during OAuth login flows. This might allow unauthorized actions on behalf of authenticated users, such as account takeover or data manipulation, if the application relies on OAuth for authentication.

Mitigation Strategies

Update @hono/oauth-providers to version 0.8.6 or later to patch the missing state check vulnerability.

Hi! I’m here to help you understand CVE-2026-81888. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70