Authentication Middleware Vulnerability in Hono's OAuth Providers
CVE-2026-81888

5.4MEDIUM

Key Information:

Vendor

Honojs

Status
@hono/oauth-providers
Vendor
CVE Published:
31 August 2026

What is CVE-2026-81888?

The authentication middleware for Hono's oauth-providers, prior to version 0.8.6, allows for potential security issues due to its handling of OAuth login callbacks. Specifically, it accepts these callbacks even if the 'state' value is missing from both the client and server sides. This oversight bypasses the intended anti-CSRF protection, which should ensure that OAuth callbacks are legitimately initiated by genuine login attempts. Users are advised to update to the patched version, 0.8.6, to mitigate this vulnerability.

Affected Version(s)

@hono/oauth-providers < 0.8.6

References

https://github.com/honojs/middleware/security/advisories/...
x_refsource_CONFIRM
https://github.com/honojs/middleware/pull/2040
x_refsource_MISC
https://github.com/honojs/middleware/commit/b37765f40b7bd...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.