{"action":"Upgrade @hono/oauth-providers to 0.8.6 or later.","affected":[{"fixed":"0.8.6","introduced":"0"}],"component":"@hono/oauth-providers","cve_ids":["CVE-2026-81888"],"ecosystem":"npm","epss":0.00191,"exploited":false,"fixed_versions":["0.8.6"],"ghsa_id":"GHSA-fm3f-ch8h-qw8q","id":"tcs_01M5KFNR1SY3MGN9C3FTJPX22V","modified_at":"2026-09-15T05:30:05.053019533Z","published_at":"2026-08-31T20:30:50Z","references":["https://osv.dev/vulnerability/GHSA-fm3f-ch8h-qw8q","https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q","https://github.com/honojs/middleware/pull/2040","https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1","https://github.com/honojs/middleware","https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-fm3f-ch8h-qw8q","url":"https://osv.dev/vulnerability/GHSA-fm3f-ch8h-qw8q"}],"summary":"@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking"}