CVE-2026-81888

Name of the Vulnerable Software and Affected Versions @hono/oauth-providers versions prior to 0.8.6

Description Built-in social login providers for the google, github, facebook, discord, twitch, linkedin, and msentra providers fail to properly validate the state value during OAuth callbacks. The system treats two absent state values as a match, allowing callbacks that did not originate from a genuine login attempt to pass the anti-CSRF (Cross-Site Request Forgery) check. This occurs because the csrf() middleware only inspects form-style requests and treats the OAuth callback GET navigation as safe. This flaw can lead to login CSRF, where a victim is silently logged into an attacker's account, or forced account linking, where an attacker's identity is linked to the victim's account.

Recommendations Update to version 0.8.6.