https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:21:37 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-362494 EUVD-2026-362494 https://cve.radiocsirt.org/vuln/euvd-2026-362494 https://cve.radiocsirt.org/vuln/fkie_cve-2026-81888 <p>@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.</p> <p>@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-81888 https://cve.radiocsirt.org/vuln/ghsa-fm3f-ch8h-qw8q <p><strong>Affected:</strong> npm: @hono/oauth-providers</p> <p>### Summary</p> <p>The built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage.</p> <p>### Details</p> <p>The `state` check treated two absent values as a match, so a callback that omits `state` — and for which no `state` was ever stored — was allowed to redeem the authorization code. Hono&#39;s `csrf()` middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level `GET` navigation it treats as safe.</p> <p>This affects the `google`, `github`, `facebook`, `discord`, `twitch`, `linkedin`, and `msentra` providers. The `x` (Twitter) provider is not exploitable due to its PKCE binding.</p> <p>### Impact</p> <p>An attacker can make a victim&#39;s browser complete an OAuth callback that binds the attacker&#39;s identity instead of the victim&#39;s, leading to login CSRF (the victim silently acts inside the attacker&#39;s account) or forced account linking (the attacker&#39;s identity is linked to the victim&#39;s account, enabling later sign-in as the victim). Affects applications using an affected provider on `@hono/oauth-providers` `0.8.5` or earlier.</p> <p><strong>Affected:</strong> npm: @hono/oauth-providers</p> <p>### Summary</p> <p>The built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage.</p> <p>### Details</p> <p>The `state` check treated two absent values as a match, so a callback that omits `state` — and for which no `state` was ever stored — was allowed to redeem the authorization code. Hono&#39;s `csrf()` middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level `GET` navigation it treats as safe.</p> <p>This affects the `google`, `github`, `facebook`, `discord`, `twitch`, `linkedin`, and `msentra` providers. The `x` (Twitter) provider is not exploitable due to its PKCE binding.</p> <p>### Impact</p> <p>An attacker can make a victim&#39;s browser complete an OAuth callback that binds the attacker&#39;s identity instead of the victim&#39;s, leading to login CSRF (the victim silently acts inside the attacker&#39;s account) or forced account linking (the attacker&#39;s identity is linked to the victim&#39;s account, enabling later sign-in as the victim). Affects applications using an affected provider on `@hono/oauth-providers` `0.8.5` or earlier.</p> https://cve.radiocsirt.org/vuln/ghsa-fm3f-ch8h-qw8q