{"id":"CVE-2026-61687","aliases":["GHSA-phg3-3g28-wq9v","GO-2026-6535"],"url":"https://o3.security/vulnerability/CVE-2026-61687","summary":"hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState","details":"### Summary\n\nHatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation). \n\nThe vulnerable code clears the session `oauth_state_<integration>` value to the empty string `\"\"` after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty `?state=` parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF). \n\n\n### Impact\n\nAffected configurations: any deployment that has enabled at least one of `auth.google.enabled`, `auth.github.enabled`, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on `main` HEAD and in every tagged release up to and including v0.86.26 (commit `243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23`).","published":"2026-09-21T15:45:27.610Z","modified":"2026-10-21T02:53:05.184244201Z","cvss":{"score":7.1,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Go","name":"hatchet","fixedVersion":"0.91.1"}],"fix":{"url":"https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428","label":"hatchet-dev/hatchet@f904641"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61687.json"},{"type":"ADVISORY","url":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61687"},{"type":"FIX","url":"https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428"},{"type":"PACKAGE","url":"https://github.com/hatchet-dev/hatchet"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:53:05.184244201Z"}}