CVE-2026-81888

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-81888
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81888.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-81888
Aliases
Published
2026-08-31T20:27:33Z
Modified
2026-10-28T02:30:41Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking
Details

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Version 0.8.6 has a patch.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-1275",
        "CWE-352"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81888.json"
}
References

Affected packages

Git / github.com/honojs/middleware

Affected ranges

Type
GIT
Repo
https://github.com/honojs/middleware
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
a43558b2d60b594b7370eac3fe8811ad66c6de7c
Fixed
b37765f40b7bddb1d8fce39573b085222dea58c1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "0.8.6"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "b37765f40b7bddb1d8fce39573b085222dea58c1"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

@hono/clerk-auth@1.*
@hono/clerk-auth@1.0.0
@hono/esbuild-transpiler@0.*
@hono/esbuild-transpiler@0.1.0
@hono/esbuild-transpiler@0.1.1
@hono/esbuild-transpiler@0.1.2
@hono/firebase-auth@1.*
@hono/firebase-auth@1.1.0
@hono/firebase-auth@1.2.0
@hono/firebase-auth@1.3.0
@hono/firebase-auth@1.3.1
@hono/firebase-auth@1.3.2
@hono/firebase-auth@1.3.3
@hono/graphql-server@0.*
@hono/graphql-server@0.2.0
@hono/graphql-server@0.4.0
@hono/graphql-server@0.4.1
@hono/hello@0.*
@hono/hello@0.0.11
@hono/hello@0.0.13
@hono/hello@0.0.14
@hono/hello@0.0.15
@hono/hello@0.0.8
@hono/hello@0.1.0
@hono/hello@0.1.1
@hono/medley-router@0.*
@hono/medley-router@0.0.1
@hono/medley-router@0.0.2
@hono/medley-router@0.0.3
@hono/qwik-city@0.*
@hono/qwik-city@0.0.1
@hono/qwik-city@0.0.2
@hono/qwik-city@0.0.3
@hono/qwik-city@0.0.4
@hono/sentry@0.*
@hono/sentry@0.0.6
@hono/sentry@0.1.0
@hono/sentry@0.2.0
@hono/sentry@0.2.1
@hono/sentry@0.2.2
@hono/sentry@1.*
@hono/sentry@1.0.0
@hono/swagger-ui@0.*
@hono/swagger-ui@0.1.0
@hono/trpc-server@0.*
@hono/trpc-server@0.0.1
@hono/trpc-server@0.0.2
@hono/trpc-server@0.1.0
@hono/typebox-validator@0.*
@hono/typebox-validator@0.0.1
@hono/typebox-validator@0.1.0
@hono/typebox-validator@0.1.1
@hono/typebox-validator@0.2.0
@hono/typebox-validator@0.2.1
@hono/typebox-validator@0.2.2
@hono/typia-validator@0.*
@hono/typia-validator@0.0.2
@hono/typia-validator@0.0.3
@hono/valibot-validator@0.*
@hono/valibot-validator@0.1.0
@hono/valibot-validator@0.1.1
@hono/valibot-validator@0.1.2
@hono/valibot-validator@0.2.0
@hono/valibot-validator@0.2.1
@hono/zod-openapi@0.*
@hono/zod-openapi@0.0.1
@hono/zod-openapi@0.1.0
@hono/zod-openapi@0.1.1
@hono/zod-openapi@0.1.2
@hono/zod-openapi@0.2.0
@hono/zod-openapi@0.3.0
@hono/zod-openapi@0.3.1
@hono/zod-openapi@0.4.0
@hono/zod-openapi@0.5.0
@hono/zod-openapi@0.5.1
@hono/zod-openapi@0.6.0
@hono/zod-openapi@0.7.0
@hono/zod-openapi@0.7.1
@hono/zod-openapi@0.7.2
@hono/zod-openapi@0.8.0
@hono/zod-openapi@0.8.1
@hono/zod-openapi@0.8.2
@hono/zod-openapi@0.8.3
@hono/zod-openapi@0.8.4
@hono/zod-openapi@0.8.5
@hono/zod-validator@0.*
@hono/zod-validator@0.0.1
@hono/zod-validator@0.0.2
@hono/zod-validator@0.0.3
@hono/zod-validator@0.0.4
@hono/zod-validator@0.0.5
@hono/zod-validator@0.0.6
@hono/zod-validator@0.1.0
@hono/zod-validator@0.1.1
@hono/zod-validator@0.1.10
@hono/zod-validator@0.1.11
@hono/zod-validator@0.1.2
@hono/zod-validator@0.1.3
@hono/zod-validator@0.1.4
@hono/zod-validator@0.1.5
@hono/zod-validator@0.1.6
@hono/zod-validator@0.1.7
@hono/zod-validator@0.1.8
@hono/zod-validator@0.1.9
@honojs/hello@0.*
@honojs/hello@0.0.7
@honojs/trpc-adapter@0.*
@honojs/trpc-adapter@0.0.0
v0.*
v0.0.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-81888.json"