Executive brief
@hono/oauth-providers is a Node.js library that handles social login flows for web applications using providers like Google and GitHub. The library's OAuth state validation incorrectly treats two missing state values as a valid match, allowing attackers to bypass anti-CSRF protections. An attacker can craft a malicious login callback that silently logs a victim into the attacker's account or links the attacker's identity to the victim's existing account, enabling unauthorized access later.
Technical details
The vulnerability exists in the OAuth state parameter validation logic across multiple social login providers (Google, GitHub, Facebook, Discord, Twitch, LinkedIn, Microsoft Entra). The vulnerable code treats an absent state value on the callback as matching an absent stored state value, incorrectly passing the anti-CSRF check. This is a logic flaw in the comparison function that should require a state value to be present and match. The attack vector is network-based and requires user interaction—the victim must follow an attacker-controlled link or visit an attacker-controlled page containing the malicious OAuth callback. The Twitter/X provider is not exploitable because it uses PKCE binding, which provides an additional security layer. Hono's existing CSRF middleware cannot mitigate this since it only protects form-style requests, not top-level GET navigations. The vulnerability was patched in version 0.8.6.
Affected products
- Hono @hono/oauth-providers < 0.8.6
Timeline
- 2026-07-16: disclosed: Initially published to GitHub Advisory Database
- 2026-08-31: patched: Patch released in version 0.8.6
- 2026-08-31: advisory: Advisory updated and reviewed