CVE-2026-81888: Honojs @hono/oauth-Providers

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.

Affected products

• Honojs @hono/oauth-Providers: before 0.8.6 (fixed in 0.8.6)

Published 2026-08-31. Last modified 2026-09-09.