CVE-2026-81888: Hono OAuth Providers CSRF Vulnerability

CVE-2026-81888 Overview

CVE-2026-81888 is a Cross-Site Request Forgery [CWE-352] vulnerability in @hono/oauth-providers, the authentication middleware for the Hono web framework. Versions prior to 0.8.6 accept an OAuth callback even when the state value is absent from both the request and the stored cookie. The anti-CSRF check passes for a callback that never came from a genuine login attempt, defeating the state-based CSRF protection under default usage. The maintainers released a fix in version 0.8.6.

Critical Impact
Attackers can forge OAuth callback requests to log victims into attacker-controlled accounts, enabling login CSRF against applications using Discord, Facebook, Google, GitHub, LinkedIn, X, or Twitch social login providers.

Affected Products

@hono/oauth-providers versions prior to 0.8.6
Hono applications using built-in social login providers (Discord, Facebook, and other bundled providers)
Node.js and edge-runtime deployments consuming the vulnerable middleware

Discovery Timeline

2026-08-31 - CVE-2026-81888 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81888

Vulnerability Analysis

The middleware implements OAuth 2.0 authorization code flow and stores a state value in a cookie before redirecting the user to the identity provider. On callback, the middleware is expected to compare the returned state query parameter against the stored cookie value. The vulnerable implementation only performs this comparison when the request URL contains a query string, and it treats two undefined values as equal.

When an attacker crafts a callback URL that omits the state parameter, the stored cookie may also be absent, so both sides evaluate to undefined. The equality check passes and the middleware proceeds to exchange the attacker-supplied authorization code for tokens. The victim is then silently logged in to the attacker's account, which the attacker can later access to view data the victim uploaded under that session.

Root Cause

The root cause is a fail-open comparison in the callback handler. The check c.req.query('state') !== storedState returns false when both sides are undefined, so the HTTPException(401) is never thrown. The guard if (c.req.url.includes('?')) also skipped validation entirely when no query string was present, further widening the bypass.

Attack Vector

Exploitation requires user interaction: the victim must click an attacker-supplied link or load an attacker-controlled page that triggers the crafted callback request. Because the flow is network-reachable and requires no privileges on the target application, any public login endpoint using the vulnerable middleware is in scope.

typescript

// Patched code in packages/oauth-providers/src/providers/discord/discordAuth.ts
// and packages/oauth-providers/src/providers/facebook/facebookAuth.ts
        maxAge: 60 * 10,
        httpOnly: true,
        path: '/',
-       // secure: true,
+       secure: true,
+       sameSite: 'Lax',
      })
      return c.redirect(auth.redirect())
    }

    // Avoid CSRF attack by checking state
-   if (c.req.url.includes('?')) {
+   if (auth.code) {
      const storedState = getCookie(c, 'state')
-     if (c.req.query('state') !== storedState) {
+     const state = c.req.query('state')
+     if (!storedState || !state || state !== storedState) {
        throw new HTTPException(401)
      }
    }

Source: GitHub Commit b37765f. The patch fails closed when either storedState or state is missing and hardens the state cookie with secure and sameSite: 'Lax'.

Detection Methods for CVE-2026-81888

Indicators of Compromise

OAuth callback requests to provider routes (for example, /discord, /facebook, /google) that lack a state query parameter but include a valid code parameter.
Successful login events where the associated request has no state cookie set on the client.
Newly linked social accounts belonging to identity provider users that do not match the victim's known identifiers.

Detection Strategies

Inspect application logs for callback requests missing the state parameter and correlate with authenticated session creation.
Audit installed versions of @hono/oauth-providers across repositories and build artifacts using npm ls @hono/oauth-providers or SBOM tooling.
Add server-side logging that records the presence and match status of the state cookie and query parameter on every OAuth callback.

Monitoring Recommendations

Alert on anomalous spikes in OAuth login volume from a single referrer or user agent.
Monitor for authenticated sessions that immediately unlink or relink external identity provider accounts.
Track HTTP 401 rates on OAuth callback routes after upgrading, since the patched middleware fails closed and legitimate misconfigurations will surface.

How to Mitigate CVE-2026-81888

Immediate Actions Required

Upgrade @hono/oauth-providers to version 0.8.6 or later across all services and edge deployments.
Invalidate active sessions created by the OAuth flow prior to the upgrade and force reauthentication for affected users.
Review linked social identities in user records for anomalies and unlink attacker-controlled accounts.

Patch Information

The fix is delivered in @hono/oauth-providers v0.8.6 via Pull Request #2040 and commit b37765f. Details are published in GitHub Security Advisory GHSA-fm3f-ch8h-qw8q. The patched middleware requires both a stored state cookie and a matching state query parameter, and it sets the cookie with secure and sameSite: 'Lax'.

Workarounds

If an immediate upgrade is not possible, wrap the OAuth callback handler with custom middleware that rejects requests missing either the state query parameter or the state cookie.
Enforce Secure and SameSite=Lax attributes on the state cookie at the reverse proxy or framework layer.
Restrict OAuth callback endpoints to authenticated origins where feasible and require a short-lived nonce in addition to state.

bash

# Upgrade the vulnerable package to the patched release
npm install @hono/oauth-providers@0.8.6

# Verify the resolved version in the dependency tree
npm ls @hono/oauth-providers