CVE-2026-81888
1 advisory.
npm/@hono/oauth-providers CVE-2026-81888: medium 5.4, EPSS 0.19%
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
Action: Upgrade @hono/oauth-providers to 0.8.6 or later.
npm i @hono/oauth-providers@0.8.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.8.6 | - |
Fixed versions
| 0.8.6 |
Sources
- osv: GHSA-fm3f-ch8h-qw8q
- https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q
- https://github.com/honojs/middleware/pull/2040
- https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1
- https://github.com/honojs/middleware
- https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6
CVE-2026-81888 · published · modified · JSON