CVE-2026-61687
Received Received - Intake

OAuth State Validation Bypass in Hatchet

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: GitHub, Inc.

Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-61687
EUVD
EUVD-2026-83978

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
hatchet-dev hatchet 0.91.1
hatchet-dev hatchet to 0.91.1 (exc)
hatchet-dev hatchet to 0.86.26 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1275 The SameSite attribute for sensitive cookies is not set, or an insecure value is used.
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
CWE-384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) bypass in the OAuth state validation mechanism of the Hatchet platform. It occurs when the OAuth state parameter in the session is cleared to an empty string instead of being removed after a successful OAuth callback. An attacker can exploit this by providing an empty state parameter in a victim's browser session, which incorrectly validates and allows unauthorized OAuth code exchange. This bypasses security checks and enables login CSRF attacks.

Detection Guidance

Check if your Hatchet deployment is running a version prior to 0.91.1 by inspecting the version in your deployment logs or configuration files. Look for OAuth callback endpoints in your system logs for requests with empty state parameters, which may indicate exploitation attempts.

Impact Analysis

An attacker could trick you into binding your authenticated Hatchet session to their OAuth identity, leading to unauthorized account access or takeover. This requires you to have completed an OAuth flow in the same session and the deployment to have enabled Google, GitHub, or Slack authentication. The attack is possible without special privileges and only needs network access and user interaction.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating confidentiality and integrity requirements under GDPR and HIPAA. It may result in data breaches, unauthorized data exposure, or account takeovers, which are non-compliant with these regulations' security and privacy controls.

Mitigation Strategies

Upgrade Hatchet to version 0.91.1 or later immediately. Review and update OAuth integration configurations to ensure proper state parameter handling. Monitor OAuth callback endpoints for suspicious activity involving empty state parameters.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61687. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart