CVE-2026-61687

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

CVSS v3 7.1 HIGH

7.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428
https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v

Configurations

No configuration.

History

21 Sep 2026, 16:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-21 16:17

Updated : 2026-09-24 21:25

NVD link : CVE-2026-61687

Mitre link : CVE-2026-61687

CVE.ORG link : CVE-2026-61687

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

CWE-352

Cross-Site Request Forgery (CSRF)

CWE-384

Session Fixation

CWE-1275

Sensitive Cookie with Improper SameSite Attribute

{"id": "CVE-2026-61687", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-61687", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-21T19:40:30.611465Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "hatchet-dev", "product": "hatchet", "versions": [{"status": "affected", "version": "< 0.91.1"}]}]}], "published": "2026-09-21T16:17:09.997", "references": [{"url": "https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428", "source": "security-advisories@github.com"}, {"url": "https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-352"}, {"lang": "en", "value": "CWE-384"}, {"lang": "en", "value": "CWE-1275"}]}], "descriptions": [{"lang": "en", "value": "Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1."}], "lastModified": "2026-09-24T21:25:27.050", "sourceIdentifier": "security-advisories@github.com"}