CVE-2026-61687: hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
Summary
Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation).
The vulnerable code clears the session oauthstate<integration> value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty ?state= parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF).
Impact
Affected configurations: any deployment that has enabled at least one of auth.google.enabled, auth.github.enabled, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on main HEAD and in every tagged release up to and including v0.86.26 (commit 243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23).
Other sources
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauthstate session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/hatchetto a version that resolves this vulnerability.Fixed in 0.91.1 - Upgrade
Upgrade
hatchetto a version that resolves this vulnerability.Fixed in 0.91.1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Hatchet versions before 0.91.1 are affected only when Google authentication, GitHub authentication, or the Slack integration is enabled. The relevant configuration options are auth.google.enabled and auth.github.enabled, or use of the Slack integration.
What must happen before an attacker can exploit the issue?
The victim must have completed an OAuth flow in their current Hatchet session. An unauthenticated attacker can then use an empty OAuth state value to bind that session to an OAuth identity controlled by the attacker.
Is user interaction required?
Yes. The vulnerability has a user-interaction requirement, and exploitation depends on the victim completing an OAuth flow in the current session.
What version fixes the issue?
Upgrade Hatchet to version 0.91.1 or later. The fix prevents an empty OAuth state value from being accepted after the stored state has been cleared.