CVE-2026-61687

HIGH 7.1

hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

CWE	CWE-287 CWE-352 CWE-384 CWE-1275
Vendor	hatchet-dev
Product	hatchet
Published	Sep 21, 2026

Stay Ahead of the Next One

Get instant alerts for hatchet-dev hatchet

Be the first to know when new high vulnerabilities affecting hatchet-dev hatchet are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Affected Versions

hatchet-dev / hatchet

< 0.91.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v github.com: https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428