EUVD-2026-68770
GHSA-fm3f-ch8h-qw8q
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Network-delivered, no attacker privileges needed, but victim must follow crafted link (UI:R); no availability impact; confidentiality and integrity both limited to session/account binding.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Version 0.8.6 has a patch.
AnalysisAI
OAuth state validation in @hono/oauth-providers prior to 0.8.6 fails open when the state parameter is absent from both the callback request and the stored session, treating two null values as a matching pair and bypassing CSRF protection entirely. This affects the google, github, facebook, discord, twitch, linkedin, and msentra social login providers in any Hono application using this middleware at version 0.8.5 or earlier. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target application to be using @hono/oauth-providers version 0.8.5 or earlier with at least one of these providers configured: google, github, facebook, discord, twitch, linkedin, or msentra. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score with vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N accurately reflects the threat model: the attack is network-delivered and requires no privileges on the target application, but depends on social engineering a victim to follow a crafted link (UI:R), which is the primary friction point. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade @hono/oauth-providers to version 0.8.6 or later, which enforces a fail-closed policy: a callback that omits the state parameter is rejected with HTTP 401 regardless of session state. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today