The OAuth middleware for Hono fails to verify the presence of the state token in callbacks when the token is omitted on both sides. This flaw means the anti‑CSRF check is bypassed, allowing an attacker to forge a login response and link a victim’s account to the attacker’s account without user consent. The weakness is a state‑validation bypass, covering abnormal request validation (CWE‑352) and improper authentication handling (CWE‑1275).

Applications using the @hono/oauth-providers middleware version 0.8.5 or earlier are vulnerable. The vulnerability exists in the Honojs "@hono/oauth-providers" module; any project that imports this middleware and performs social login without strict state enforcement is affected. Versions 0.8.6 and above contain the fix.

With a CVSS score of 5.4 the flaw represents moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, implying no known large‑scale exploitation yet. Attackers can exploit this via a forged OAuth callback that is not linked to a legitimate user session, potentially forcing account linking or CSRF attacks against authorized users. The attack vector is web‑based, requiring the attacker to supply a crafted callback to the application’s OAuth redirect URI. The risk remains moderate until a broader exploit is observed.