{"cve":"CVE-2026-61687","nvd":{"published":"2026-09-21T16:17:09.997","modified":"2026-09-24T21:25:27.050","status":"Deferred","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","score":7.1},"cwes":["CWE-287","CWE-352","CWE-384","CWE-1275"],"references":["https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428","https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-61687","score":0.00171,"percentile":0.06484,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-phg3-3g28-wq9v","url":"https://osv.dev/vulnerability/GHSA-phg3-3g28-wq9v","summary":"Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState","modified":"2026-09-28T17:11:11.519741965Z","packages":[{"ecosystem":"Go","name":"hatchet","purl":"pkg:golang/hatchet","ranges":["<0.91.1"],"fixed":["0.91.1"]}]},{"id":"GO-2026-6535","url":"https://osv.dev/vulnerability/GO-2026-6535","summary":"Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet","modified":"2026-10-07T17:45:12.975811531Z","packages":[{"ecosystem":"Go","name":"github.com/hatchet-dev/hatchet","purl":"pkg:golang/github.com/hatchet-dev/hatchet","ranges":["<0.91.2"],"fixed":["0.91.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}