fix(deps): update dependency @hono/oauth-providers to ^0.8.6 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@hono/oauth-providers (source)	^0.6.2 → ^0.8.6

---

@​hono/oauth-providers: OAuth state check fails open on omitted state, enabling login CSRF and forced account linking

CVE-2026-81888 / GHSA-fm3f-ch8h-qw8q

More information

Details

Summary

The built-in social login providers accept an OAuth callback even when the state value is absent on both sides, so the anti-CSRF check passes for a callback that never came from a genuine login attempt. This defeats the state-based CSRF protection under default usage.

Details

The state check treated two absent values as a match, so a callback that omits state — and for which no state was ever stored — was allowed to redeem the authorization code. Hono's csrf() middleware does not help: it only inspects form-style requests, while the OAuth callback is a top-level GET navigation it treats as safe.

This affects the google, github, facebook, discord, twitch, linkedin, and msentra providers. The x (Twitter) provider is not exploitable due to its PKCE binding.

Impact

An attacker can make a victim's browser complete an OAuth callback that binds the attacker's identity instead of the victim's, leading to login CSRF (the victim silently acts inside the attacker's account) or forced account linking (the attacker's identity is linked to the victim's account, enabling later sign-in as the victim). Affects applications using an affected provider on @hono/oauth-providers 0.8.5 or earlier.

Severity

• CVSS Score: 5.4 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

• https://github.com/honojs/middleware/security/advisories/GHSA-fm3f-ch8h-qw8q
• https://github.com/honojs/middleware/pull/2040
• https://github.com/honojs/middleware/commit/b37765f40b7bddb1d8fce39573b085222dea58c1
• https://github.com/honojs/middleware/releases/tag/%40hono%2Foauth-providers%400.8.6
• https://github.com/advisories/GHSA-fm3f-ch8h-qw8q

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

honojs/middleware (@​hono/oauth-providers)

v0.8.6

Compare Source

Patch Changes

• #​2040 b37765f40b7bddb1d8fce39573b085222dea58c1 Thanks @​yusukebe! - fix: fail closed on missing OAuth state to prevent login CSRF

v0.8.5

Compare Source

Patch Changes

• #​1404 fce74aeda2958faa4d0ed17dfcfe7cbbb74287fa Thanks @​sushichan044! - fix: enable CSRF protection for MSEntra ID authentication

  Fixed a bug where the state parameter was not being passed to the MSEntra AuthFlow constructor. As a result, CSRF protection now properly works for MSEntra ID authentication, ensuring that authentication requests are protected against Cross-Site Request Forgery attacks.

v0.8.4

Compare Source

Patch Changes

• #​1372 1980a66370d4afc8d552ac08bd25af0c87b49112 Thanks @​mrdear! - fixed github email request content-type

v0.8.3

Compare Source

Patch Changes

• #​1364 ba19e66f6d086089e15b04bc866c7ebf9cd43409 Thanks @​rxliuli! - handle refersh_token on googleAuth

v0.8.2

Compare Source

Patch Changes

• #​1254 e1e8a6626d4a739f40ec1ac97c1671322522bee6 Thanks @​BarryThePenguin! - Update package repository

v0.8.1

Compare Source

Patch Changes

• #​1201 641fd4c3de6d3248f131a09748f55a9007d7f77c Thanks @​BarryThePenguin! - Add explicit return types

v0.8.0

Compare Source

Minor Changes

• #​1163 cf48336cbd123a45b461caaa41325d2302182901 Thanks @​BarryThePenguin! - The PR adds Microsoft Entra (AzureAD) to the list of supported 3rd-party OAuth providers.

v0.7.1

Compare Source

Patch Changes

• #​1099 091b182a6ac1b7bb1129123d3cd0acca5e41b80d Thanks @​liquidleif! - fix: Update twitter authorization url

v0.7.0

Compare Source

Minor Changes

• #​981 e5f383787c2bd47657f67a99074515eab969963b Thanks @​Younis-Ahmed! - These chages introduces a Twitch OAuth provider, expanding the middleware's OAuth offerings. It includes a new middleware for Twitch authentication, a dedicated AuthFlow class, token refreshing/revocation/validation, and comprehensive type definitions. Detailed tests ensure correct behavior and error handling.

  • Twitch OAuth Middleware src/providers/twitch/twitchAuth.ts: Implements the core authentication flow, handling state management, redirects, and context variable setting (token, refresh-token, user-twitch, granted-scopes).

  • AuthFlow Class src/providers/twitch/authFlow.ts: Encapsulates token exchange and user data retrieval, with robust error handling.

  • Token Operations src/providers/twitch/refreshToken.ts: Provides functions for refreshing and revoking tokens.

  • Type Definitions `src/providers/twitch/types.ts: Defines comprehensive types for Twitch API responses.

  • Extensive Testing (test/handlers.ts, test/index.test.ts): Includes unit tests covering redirection, valid code flow, error handling, refresh/revoke token, custom and built-in state scenarios, using a mock server.

  • Validate Token src/providers/twitch/validateToken: That hit /validate endpoint to verify that the access token is still valid for reasons other than token expiring.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.