CVE-2026-81888Medium· 5.4▾ Sunlit@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a ca…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.1%
Last analysed / modified upstream
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Version 0.8.6 has a patch.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
@hono/oauth-providers < 0.8.6Patched in:
@hono/oauth-providers 0.8.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61687High· 7.1Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale
CVE-2026-73847Medium· 6.8Emlog is an open source website building system
CVE-2026-84365Medium· 6.5Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-84364Medium· 5.3Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2026-84363Medium· 5.9Hono is a Web application framework that provides support for any JavaScript runtime
CVE-2017-20120Medium· 4.3A vulnerability classified as problematic was found in TrueConf Server 4.3.7