EUVD-2026-83978
GHSA-phg3-3g28-wq9v
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAttacker starts own OAuth flow for own code
-
DeliveryLure victim mid-session to crafted callback URL
-
ExploitEmpty ?state= collides with cleared session state
-
ExecutionValidateOAuthState wrongly validates
-
ImpactVictim session bound to attacker OAuth identity
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication mechanism validation
MITRE ATT&CK
2 techniques across 2 tactics: Defense Evasion, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires ALL of: (1) the deployment has enabled at least one OAuth integration - auth.google.enabled, auth.github.enabled, or the Slack integration; (2) the victim has already completed at least one OAuth flow on that integration within the current browser session, leaving session.Values[oauth_state_<integration>] set to the empty string; and (3) victim interaction (UI:R) - the victim's browser must follow the attacker's crafted callback URL carrying code=<attacker_code>&state= (empty). The attacker is unauthenticated (PR:N) but must first obtain their own valid OAuth authorization code for the target provider. Deployments with no OAuth/Slack integration enabled, or where the victim has not performed an OAuth flow this session, are not exploitable. |
| Impact | The vendor CVSS of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N) reflects an unauthenticated network-reachable account-fixation flaw whose only friction is required victim interaction (UI:R). However the real-world risk is materially lower than the headline score suggests because exploitation is doubly gated: the victim must already be mid-session having just completed an OAuth round-trip that left oauth_state_<integration> set to empty string, AND the deployment must have enabled auth.google.enabled, auth.github.enabled, or the Slack integration. These are genuine attack requirements, so I assess AC:H rather than the vendor's AC:L (my adjusted ~6.5). No EPSS score, no CISA KEV listing, and no standalone weaponized PoC are present - though a working integration reproduction test (TestValidateOAuthState_EmptyStateBypass) ships inside the fix commit, meaning a technical reproduction is publicly available. There is no SSVC decision data supplied. Net: a legitimate account-takeover/session-binding bug worth patching, but a targeted, precondition-dependent login-CSRF rather than a mass-exploitable RCE - a moderate priority, not an emergency, especially for the niche Hatchet install base. |
| Exploit ScenarioDerived | An attacker initiates their own Google/GitHub/Slack OAuth flow to obtain an attacker-controlled authorization code, then lures an authenticated Hatchet victim (who has just completed an OAuth flow this session) to a crafted callback URL such as /api/v1/users/github/callback?code=ATTACKER_CODE&state= carrying an empty state parameter. Because ValidateOAuthState left the stored state as "" and treats the empty ?state= as a match, the victim's browser session cookie gets bound to the attacker's OAuth identity (account fixation). A public reproduction test demonstrating the empty-state bypass is included in the 0.91.1 fix commit. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 21, 2026
Account fixation in Hatchet's OAuth callback handling lets an unauthenticated attacker bind a victim's existing Hatchet session to an OAuth identity the attacker controls, achieving login CSRF and account takeover. The flaw affects Hatchet versions prior to 0.91.1 and is only reachable when the deployment has enabled at least one OAuth integration (auth.google.enabled, auth.github.enabled, or the Slack integration) and the victim has already completed an OAuth flow in the current browser session; exploitation still requires victim interaction (the victim's browser must follow the attacker's crafted callback URL containing an empty state parameter and the attacker's own authorization code). The vendor-released patch is version 0.91.1 (upstream commit f90464189ad642251e09412d0f99fde353036428); there is no indication of confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, although the upstream fix ships an integration test that documents the bypass chain.
RemediationAI
Upgrade Hatchet to version 0.91.1, which is the vendor-released patch for CVE-2026-61687 and contains commit f90464189ad642251e09412d0f99fde353036428; the commit rejects an empty ?state= parameter, requires a non-empty string stored state, replaces the equality check with crypto/subtle.ConstantTimeCompare, and deletes the oauth_state_<integration> and oauth_triggered session keys after a successful callback rather than blanking them. Advisory details are at https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v. If upgrading immediately is not possible, disable the exposed integrations by setting auth.google.enabled=false, auth.github.enabled=false, and disabling the Slack integration; the trade-off is loss of SSO/Slack sign-in for all users until the upgrade is applied. As a supplementary control, force invalidation of existing user sessions (rotating the session/cookie signing secrets or expiring the user session store) so that any session already holding an emptied oauth_state_* value cannot be abused, and monitor callback endpoints (e.g. /api/v1/users/<provider>/callback) for requests carrying an empty state parameter as a detection signal. Note that the patch itself is a callback-path change, so no functional configuration changes are required after upgrading.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Hatchet is a Go-based platform for orchestrating background tasks, AI agents, and durable workflows, using the Echo web framework and cookie-backed server-side sessions. The vulnerable routine, SessionHelpers.ValidateOAuthState in api/v1/server/authn/session_helpers.go, implements the OAuth 2.0 'state' parameter check intended to bind an authorization callback to the browser session that initiated it. After a successful callback the code set session.Values["oauth_state_<integration>"] to the empty string instead of deleting the key, and the subsequent equality check compared the incoming ?state= query value against the stored value without rejecting an empty provided value, without a type assertion on the stored value, and without constant-time comparison. Because an empty state therefore compared equal to the emptied stored state, the single-use anti-CSRF token effectively became replayable as a predictable empty string. CWE-287 (Improper Authentication) is the correct root-cause class: the state token is the sole authentication binding for the OAuth round trip, so its predictable/empty acceptance lets an attacker's authorization code be exchanged inside the victim's authenticated session, rebinding the session to the attacker's identity. The fix adds an explicit rejection of a missing/empty state parameter, a string type assertion that treats a non-string or empty stored value as invalid, a crypto/subtle.ConstantTimeCompare between provided and stored state, and full deletion of the oauth_state_* and oauth_triggered keys after use. CPE cpe:2.3:a:hatchet-dev:hatchet:*:*:*:*:*:*:*:* confirms the package-level scope, and the advisory notes the bug was present on main HEAD and in every tagged release up to and including v0.86.26, with the metadata range stating vulnerable < 0.91.1.
Know when Hatchet gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N
Unauthenticated network login-CSRF (PR:N/AV:N) but the victim-mid-OAuth-session and provider-enabled preconditions plus required victim click raise AC:H/UI:R; account fixation yields I:H, minor identity read C:L, no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.
Technical POC Analysis
Bug class: improper authentication (CWE-287), with the advisory also mapping CWE-352 (CSRF), CWE-384 (session fixation) and CWE-1275 (sensitive cookie with improper SameSite).
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 public PoC link from github
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Hatchet workflow orchestration deployments that have enabled Google, GitHub, or Slack OAuth login are exposed to an account-takeover flaw that lets an attacker bind a victim's existing Hatchet session to an OAuth identity the attacker controls, granting the attacker that user's access to the platform. The issue is constrained by deployment configuration (at least one OAuth integration enabled and a victim who has already completed an OAuth sign-in in the same browser session) and requires the victim to follow a crafted callback link, so impact is concentrated in organizations using SSO/OAuth rather than all Hatchet users. Leadership should care because a successful attack yields unauthorized access to the workflow and automation platform itself, which typically holds credentials, code execution privileges, and integration secrets.
Apply vendor patch. Until the upgrade to Hatchet 0.91.1 or later can be completed, interim mitigations are to disable all OAuth integrations (auth.google.enabled, auth.github.enabled, and the Slack integration) and restrict sign-in to methods that do not rely on the vulnerable callback handling.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Cross-tenant information disclosure in Hatchet before 0.106.1 allows an authenticated tenant worker in a multi-tenant de
Cross-tenant disclosure of durable workflow callback results in Hatchet before 0.95.3 lets an authenticated tenant worke
Unauthenticated remote attackers can exhaust server memory in Hatchet 0.110.5 and earlier by sending arbitrarily large o
Hatchet deployments prior to 0.91.1 expose a cross-tenant insecure direct object reference (IDOR) on the durable-task ev
Server-side request forgery in Hatchet versions prior to 0.91.1 lets an authenticated tenant of the platform coerce the
Exploit-DB