CVE-2026-61687 is a high-severity (CVSS 7.1) Improper Authentication vulnerability in hatchet. A fix is available for hatchet — see the affected versions and patch details below.
hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
Exploitation Status
No confirmed exploitation observed yet
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-61687.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-61687 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 394,415 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
hatchetReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation).
The vulnerable code clears the session oauth_state_<integration> value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty ?state= parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF).
Impact
Affected configurations: any deployment that has enabled at least one of auth.google.enabled, auth.github.enabled, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on main HEAD and in every tagged release up to and including v0.86.26 (commit 243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23).
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | hatchet | all versions | 0.91.1go get hatchet@v0.91.1 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for hatchet, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update hatchet to 0.91.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-61687 is resolved across your whole dependency graph.
Workarounds
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is CVE-2026-61687 in your dependencies?
Find it across Go, including transitive dependencies.