Description

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-31T21:17:52.317Z",
  "pubdate": "2026-08-31T21:17:52.317Z",
  "executiveSummary": "A Cross-Site Request Forgery (CSRF) vulnerability exists in @hono/oauth-providers prior to version 0.8.6. The flaw resides in the handling of the OAuth callback mechanism, where the implementation fails to enforce the validation of the 'state' parameter.\nThe vulnerability occurs because the built-in social login providers permit the completion of an OAuth callback handshake even when the 'state' parameter is missing from both the initial request and the callback response. This failure effectively disables the anti-CSRF protection mechanism, which is intended to bind authentication callbacks to specific user-initiated login sessions.\nSuccessful exploitation allows an attacker to force a victim's browser to connect an attacker-controlled external account to the victim's local application account without the victim's knowledge or consent. This vulnerability poses significant risk to user integrity, potentially allowing attackers to hijack sessions or perform unauthorized account linkages. The exploit requires no special privileges beyond the ability to influence a victim's interaction with the target application's callback endpoint. The vulnerability is remediated in version 0.8.6, which enforces strict 'state' parameter verification.",
  "technicalDetails": "The vulnerability is located in the authentication middleware logic of @hono/oauth-providers. The root cause is a permissive validation failure within the callback handling routine, which does not strictly require the presence and parity of the 'state' parameter.\nIn a secure OAuth flow, the 'state' parameter is an opaque string generated by the client application and stored in the user's session before the user is redirected to the Authorization Server. Upon returning to the application's callback URL, the client must verify that the 'state' returned by the provider matches the one stored in the session. This binds the authentication result to the original request, preventing a third party from injecting an unauthorized callback response.\nIn the affected versions of @hono/oauth-providers, the middleware logic incorrectly treats the absence of the 'state' parameter as a valid state. Specifically, the implementation does not reject the OAuth callback if both the incoming request and the stored session lack the 'state' value. Consequently, the middleware logic proceeds to exchange an authorization code for an access token and establishes an authenticated context, essentially treating an unsolicited callback as a legitimate response to a user-initiated login.\nThe attack flow proceeds as follows: 1) An attacker initiates an OAuth flow with the target application to obtain a valid callback URL, or crafts a callback request that satisfies the application's expected format. 2) The attacker lures a logged-in or targeted victim to navigate to the crafted callback URL. 3) Because the middleware fails to perform strict 'state' parity checks, the application processes the attacker's supplied authorization code or authentication metadata. 4) The victim's application session becomes associated with the identity provided by the attacker’s OAuth account, or the application mistakenly completes an authentication flow on behalf of the victim using the attacker’s credentials.\nThis vulnerability is classified as an authorization bypass resulting from insufficient CSRF defenses. The impact is significant because it allows attackers to bypass the non-repudiation and integrity guarantees of the OAuth handshake. By omitting the 'state' validation, the component becomes susceptible to state-less callback injection, which can lead to account linking confusion or the unintended authentication of the victim as the attacker, potentially leading to unauthorized data access or session hijacking scenarios.\nThe issue is present across all built-in social login providers offered by the library prior to the release of version 0.8.6. No complex network interception is required; simple link manipulation or social engineering is sufficient to trigger the callback endpoint in the victim's context."
}