Hono Oauth Providers
Monthly
OAuth state validation in @hono/oauth-providers prior to 0.8.6 fails open when the state parameter is absent from both the callback request and the stored session, treating two null values as a matching pair and bypassing CSRF protection entirely. This affects the google, github, facebook, discord, twitch, linkedin, and msentra social login providers in any Hono application using this middleware at version 0.8.5 or earlier. An attacker who tricks a victim into visiting a crafted OAuth callback URL can silently bind the attacker's third-party identity to the victim's session (login CSRF) or permanently link the attacker's account to the victim's account (forced account linking), enabling later sign-in as the victim. No public exploit has been identified at time of analysis.
OAuth state validation in @hono/oauth-providers prior to 0.8.6 fails open when the state parameter is absent from both the callback request and the stored session, treating two null values as a matching pair and bypassing CSRF protection entirely. This affects the google, github, facebook, discord, twitch, linkedin, and msentra social login providers in any Hono application using this middleware at version 0.8.5 or earlier. An attacker who tricks a victim into visiting a crafted OAuth callback URL can silently bind the attacker's third-party identity to the victim's session (login CSRF) or permanently link the attacker's account to the victim's account (forced account linking), enabling later sign-in as the victim. No public exploit has been identified at time of analysis.