CVE-2026-54290: Hono CORS Credential Reflection Vulnerability (v4.12.25)

Technical summary

The vulnerability exists in Hono's CORS middleware implementation prior to version 4.12.25. When the credentials option is set to true and no explicit origin whitelist is provided (allowing the wildcard default), the middleware reflects the Origin header from incoming requests directly into the Access-Control-Allow-Origin response header and simultaneously sets Access-Control-Allow-Credentials: true. This combination violates CORS security principles: a credentialed origin header reflection allows any attacker-controlled origin to satisfy the browser's CORS preflight, enabling cross-origin requests with the victim's cookies or authentication tokens attached. An attacker can embed a script on their site that makes requests to the target Hono application; the victim's browser will automatically include credentials, and the attacker receives the response due to the reflected origin permission. The issue is classified under CWE-942 (Permissive Cross-Domain Policy).

Business impact

Exposure of cookie-authenticated endpoints represents a direct compromise of user sessions and sensitive data. In production environments, this allows attackers to perform actions on behalf of authenticated users, access confidential information, or modify application state without the user's knowledge. The risk scales with the sensitivity of data handled by the Hono application and the number of active users. Organizations running Hono APIs that serve sensitive information or enable state-changing operations face potential data breaches, unauthorized transactions, or regulatory violations. The attack requires user interaction (the victim must visit an attacker's site), but the barrier is low—social engineering or compromised third-party sites are common vectors.

Affected systems

All Hono applications running versions prior to 4.12.25 with CORS middleware configured to accept credentials and without an explicit origin whitelist are vulnerable. This includes both standalone Hono servers and Hono applications embedded in larger JavaScript runtime environments. Applications using the default or permissive CORS settings are at highest risk. The vendor product list is not specified in available data; verify your Hono deployment version against the vendor advisory to confirm exposure.

Exploitability

Exploitability is high with moderate complexity. An attacker must craft a malicious web page that triggers cross-origin requests to the target application, relying on the victim visiting that page while authenticated to the Hono app. No authentication or special privileges are required on the attacker's side, and the browser's automatic credential inclusion does the heavy lifting. The attack is reliable across modern browsers. However, the attack does depend on user interaction (visiting the attacker's site), which slightly reduces immediate mass-exploitation potential compared to a purely server-side flaw. Tools and techniques for CORS exploitation are well-known in the security community.

Remediation

Upgrade Hono to version 4.12.25 or later immediately. The patch corrects the middleware to refuse origin reflection when credentials are enabled, requiring developers to explicitly whitelist safe origins instead. Organizations should also conduct a code review of CORS configurations across their Hono applications. Going forward, adopt the principle of explicit origin whitelisting: never allow wildcard origins alongside credentialed requests. If your application requires cross-origin credential access, maintain a strict list of trusted domains. Test CORS behavior with tools like curl or browser developer tools to confirm that credential requests from unauthorized origins are properly blocked.

Patch guidance

Apply Hono version 4.12.25 or later. Verify the patch by checking your package manager (npm, yarn, etc.) to ensure the installed version is at or above 4.12.25. After upgrading, restart all Hono application instances. There are no known breaking changes in the patch, but test in a staging environment first if your application has strict CORS requirements. Confirm that legitimate cross-origin requests still function properly after the upgrade.

Detection guidance

Monitor HTTP access logs for suspicious cross-origin requests originating from unexpected domains in the Origin header, particularly those with cookie-authenticated responses. Watch for patterns where different origins are sending requests to sensitive endpoints. Network detection can flag anomalous credential usage from sessions that should be localized. Examine CORS middleware configuration in your Hono codebase using grep or code scanning tools for patterns matching credentials: true combined with absent or permissive origin settings. Tools like OWASP ZAP or Burp Suite can validate CORS policy correctness by simulating cross-origin requests.

Why prioritize this

This vulnerability scores 7.1 (HIGH) due to the combination of network accessibility, low attack complexity, and high confidentiality impact. The attack bypasses application-layer access controls without requiring prior authentication or privilege, making it broadly exploitable. While user interaction is required, the barrier is trivial—any site visit suffices. The fix is straightforward and available, making rapid patching feasible. Organizations should prioritize patching in the short term, especially for production APIs handling sensitive data or enabling account modifications.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects: Attack Vector Network (AV:N) because exploitation occurs over HTTP/HTTPS; Attack Complexity Low (AC:L) because the attack requires only standard HTTP requests and relies on browser behavior; Privileges Required None (PR:N) and User Interaction Required (UI:R) because the attacker needs the victim to visit a page but requires no pre-existing access; Scope Unchanged (S:U) because the impact is confined to the targeted application; Confidentiality High (C:H) because attackers can read responses and session data; Integrity Low (I:L) because some state-changing requests may succeed if the victim is authenticated; Availability None (A:N) because the vulnerability does not disrupt service. The HIGH severity reflects the practical risk of session hijacking and data exposure in production environments.

Frequently asked questions