CVE-2026-81888

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

GHSA-FM3F-CH8H-QW8Q @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

@meow-meow-dev/server-utilities (>=1.0.1, <=3.5.2), @nile-squad/nile (>=1.2.0, <=1.4.11) +2 more potentially affected by CVE-2026-81888 via @hono/oauth-providers (>=0.6.2, <=0.8.5)

@hono/oauth-providers NPM version =0.6.2, =1.0.1, =1.2.0, =0.1.0, =0.1.1, =0.8.3 Source cves: CVE-2026-81888 Source advisory: OSV:GHSA-FM3F-CH8H-QW8Q...

@hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

Summary The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage. Details The state...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

EUVD-2026-68770

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888 @hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

CVE-2026-81888

@hono/oauth-providers , authentication middleware for the Hono web framework, has a flaw in its OAuth state validation. Prior to version 0.8.6 , the built-in social login providers accept an OAuth callback even when the state value is absent on both the expected and received sides, causing the an...

CVE-2026-81888: Cross-Site Request Forgery (CSRF)

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

PT-2026-84019

@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This...

EUVD-2026-63844

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's OAuth authentication plugin while listing OAuth providers. This issue affects Apache CloudStack: from 4.19.0.0 through 4.20.3.0 and from 4.21.0.0 through 4.22.1.0. Users are recommended to upgrade to...

PT-2026-79319

Name of the Vulnerable Software and Affected Versions Apache CloudStack versions 4.19.0.0 through 4.20.3.0 Apache CloudStack versions 4.21.0.0 through 4.22.1.0 Description An issue in the OAuth authentication plugin occurs while listing OAuth providers, leading to the exposure of sensitive...

CVE-2026-55205

Hermes WebUI prior to 0.51.468 is affected by a resource-exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint. The issue allows unbounded accumulation of in-memory flow state and daemon threads, enabling repeated or concurrent requests to exhaust server memory...

CVE-2025-7736 Incorrect Authorization in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.9 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated attacker to bypass access control restrictions and view GitLab Pages content intended only for project members by...