CyberRota Analysis
AI-GeneratedThe authentication middleware for Hono is vulnerable due to its handling of OAuth callbacks, which allows the acceptance of callbacks without a `state` value, undermining CSRF protection. This flaw can lead to unauthorized access through CSRF attacks, particularly affecting applications relying on social login features. Developers and security teams using versions prior to 0.8.6 should prioritize upgrading to the patched version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
@hono/oauth-providers is Authentication middleware for Hono. Prior to version 0.8.6, the built-in social login providers accept an OAuth callback even when the `state` value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the `state`-based CSRF protection under default usage. Version 0.8.6 has a patch.