Skip to content
OpenAdvisories

Package · npm

@hono/oauth-providers

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.4
    CVE-2026-81888

    @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

    @hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came…

    honojs @hono/oauth-providers @hono/oauth-providers npm