Listen to this Post
The built-in social login providers in `@hono/oauth-providers` accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage.
The vulnerability exists because the `state` check treated two absent values as a match. A callback that omits `state` — and for which no `state` was ever stored — was allowed to redeem the authorization code. Hono’s `csrf()` middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level `GET` navigation it treats as safe.
This affects the google, github, facebook, discord, twitch, linkedin, and msentra providers. The x (Twitter) provider is not exploitable due to its PKCE binding.
An attacker can make a victim’s browser complete an OAuth callback that binds the attacker’s identity instead of the victim’s, leading to login CSRF (the victim silently acts inside the attacker’s account) or forced account linking (the attacker’s identity is linked to the victim’s account, enabling later sign-in as the victim).
Affects applications using an affected provider on @hono/oauth-providers 0.8.5 or earlier.
DailyCVE Form:
Platform: @hono/oauth-providers
Version: ≤0.8.5
Vulnerability: CSRF (state omission)
Severity: Medium (CVSS 5.4)
date: 2026-08-31
Prediction: 2026-09-01 (patch available in v0.8.6)
What Undercode Say:
Check installed version npm list @hono/oauth-providers Upgrade to patched version npm install @hono/[email protected] Verify upgrade npm list @hono/oauth-providers
Exploit: (Educational Purposes!)
// Attacker initiates OAuth flow with their own provider credentials // Gets authorization code from provider // Victim's browser is forced to visit: // https://victim-app.com/auth/callback?code=ATTACKER_CODE // No state parameter is included in the callback URL // The vulnerable state check sees: state=undefined (callback) === state=undefined (stored) // Returns true → authorization code is redeemed // Result: Victim's session now binds to attacker's social identity
Protection:
- Upgrade `@hono/oauth-providers` to version 0.8.6 or later
- If unable to upgrade immediately, disable or remove usage of affected built-in social login providers: google, github, facebook, discord, twitch, linkedin, and msentra
- The x (Twitter) provider is safe due to PKCE binding and can remain enabled
- Implement additional CSRF defense layers (e.g., custom state validation with cryptographic nonces)
Impact:
- Login CSRF: Victim is silently logged into an attacker-controlled account and performs actions there
- Forced account linking: Attacker’s OAuth identity is linked to the victim’s account, enabling the attacker to later sign in as the victim
- Affects all applications using affected providers on `@hono/oauth-providers` versions 0.8.5 and earlier
- No authentication required to initiate the attack; only user interaction is needed
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
