CVE-2026-54290: Hono Auth Bypass Vulnerability

CVE-2026-54290 Overview

CVE-2026-54290 is a misconfiguration vulnerability in the Hono web application framework's Cross-Origin Resource Sharing (CORS) middleware. Versions prior to 4.12.25 reflect the request's Origin header back in Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true when no explicit origin is configured. Any external site can issue credentialed cross-origin requests and read the responses. This exposes cookie-authenticated endpoints to attacker-controlled origins. The flaw is categorized under CWE-942 (Permissive Cross-domain Policy with Untrusted Domains) and is fixed in Hono 4.12.25.

Critical Impact
Attackers can read responses from cookie-authenticated Hono endpoints across origins, enabling account takeover and data theft via victim browsers.

Affected Products

Hono framework versions prior to 4.12.25
Applications using Hono CORS Middleware with credentials: true and no explicit origin
JavaScript runtimes hosting vulnerable Hono applications (Node.js, Deno, Bun, Cloudflare Workers)

Discovery Timeline

2026-06-22 - CVE-2026-54290 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-54290

Vulnerability Analysis

The vulnerability resides in Hono's CORS Middleware default behavior. When developers enable credentials: true without explicitly setting an allowed origin, the middleware falls back to a wildcard configuration. Instead of refusing to attach credentials to a wildcard response, the middleware reflects the incoming Origin request header into the Access-Control-Allow-Origin response header. It simultaneously emits Access-Control-Allow-Credentials: true. This combination is explicitly forbidden by the CORS specification because it grants any origin permission to send authenticated requests and read the response body.

A malicious site loaded in a victim's browser can issue fetch calls with credentials: 'include' to the vulnerable Hono application. The browser attaches session cookies, and the response is readable by the attacker's JavaScript. This results in confidentiality loss for any endpoint protected only by cookie-based session authentication.

Root Cause

The root cause is an insecure default in the CORS Middleware. The middleware treats the absence of an explicit origin option as a permissive wildcard, then dynamically reflects the request Origin header to maintain compatibility with credentialed requests. This pattern is a well-known CORS anti-pattern that effectively disables the Same-Origin Policy for the application.

Attack Vector

Exploitation requires a victim with an active session to visit an attacker-controlled web page. The attacker's page issues a credentialed cross-origin request to the Hono application. The browser includes cookies, the server reflects the attacker's origin, and the attacker's script reads the response. No authentication or special privileges are required on the server side. See the Hono GitHub Security Advisory GHSA-88fw-hqm2-52qc for technical details.

Detection Methods for CVE-2026-54290

Indicators of Compromise

HTTP responses containing both Access-Control-Allow-Credentials: true and a reflected Access-Control-Allow-Origin matching the request Origin
Unexpected cross-origin requests in server access logs from unfamiliar referrer domains targeting authenticated API endpoints
Browser console errors or success patterns indicating credentialed fetches from third-party origins

Detection Strategies

Audit Hono application source code for cors() middleware invocations that set credentials: true without an explicit origin allowlist
Scan production HTTP responses for the combination of Access-Control-Allow-Credentials: true and dynamic origin reflection using automated DAST tools
Review dependency manifests (package.json, package-lock.json) for Hono versions earlier than 4.12.25

Monitoring Recommendations

Log and alert on cross-origin requests to authenticated endpoints where the Origin header does not match the expected application domain
Correlate session cookie usage with anomalous Origin header values in web access logs
Monitor outbound traffic from user browsers to identify potential data exfiltration patterns following CORS abuse

How to Mitigate CVE-2026-54290

Immediate Actions Required

Upgrade Hono to version 4.12.25 or later across all environments
Inventory all Hono applications and identify any CORS Middleware configurations using credentials: true
Define an explicit origin allowlist for every CORS Middleware instance handling credentialed requests
Rotate session secrets and invalidate active sessions if exploitation is suspected

Patch Information

The vulnerability is fixed in Hono 4.12.25. Upgrade via npm install hono@^4.12.25, yarn add hono@^4.12.25, or the equivalent command for your package manager. The patch enforces stricter validation when credentials: true is set, preventing wildcard origin reflection. Refer to the Hono GitHub Security Advisory for full release notes.

Workarounds

Explicitly set the origin option in CORS Middleware to a static allowlist of trusted domains instead of relying on defaults
Disable credentials: true on endpoints that do not require cookie-based authentication
Place a reverse proxy or web application firewall in front of the application to strip or validate Access-Control-Allow-Origin headers until the patch is deployed

bash

# Configuration example: explicit origin allowlist in Hono CORS middleware
import { Hono } from 'hono'
import { cors } from 'hono/cors'

const app = new Hono()

app.use('/api/*', cors({
  origin: ['https://app.example.com', 'https://admin.example.com'],
  credentials: true,
  allowMethods: ['GET', 'POST', 'PUT', 'DELETE'],
}))