Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
CVE-2026-61687 (GitHub advisory GHSA-phg3-3g28-wq9v) is a high-severity vulnerability with a CVSS 3.1 base score of 7.1, classed as Improper Authentication (CWE-287), in hatchet (Go). Affected versions: < 0.91.1. It is fixed in 0.91.1.
Published 21 Sept 2026Updated 21 Sept 2026
- CVE ID
- CVE-2026-61687
- GHSA ID
- GHSA-phg3-3g28-wq9v
- EPSS
- Not scored
- Weaknesses (CWE)
- KEV status
- Not in KEV
- Published
- 21 Sept 2026
- Updated
- 21 Sept 2026
- Ecosystem
- Go
- Assigned by (CNA)
- GitHub_M
Summary
Source: OSV (GitHub advisory)
Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation).
The vulnerable code clears the session oauth_state_<integration> value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty ?state= parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF).
Impact
Affected configurations: any deployment that has enabled at least one of auth.google.enabled, auth.github.enabled, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on main HEAD and in every tagged release up to and including v0.86.26 (commit 243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23).
Technical details
Source: GitHub Advisory Database
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:NHigh7.1Base score from GitHub Advisory Database
- Attack Vector AV
- Network
- Attack Complexity AC
- Low
- Privileges Required PR
- None
- User Interaction UI
- Required
- Scope S
- Unchanged
- Confidentiality C
- Low
- Integrity I
- High
- Availability A
- None
CISA SSVC decision points
- Exploitation
- none
- No public exploitation evidence
- Automatable
- no
- Needs manual steps per target
- Technical impact
- partial
- Limited control of the affected system
CISA Coordinator assessment (SSVC 2.0.3) via CVE.org.
Affected packages
Source: OSV (GitHub advisory)
- hatchetGo
pkg:golang/hatchet- Affected versions
- < 0.91.1
- Fixed in
- 0.91.1
| Package | Affected versions | Fixed in |
|---|---|---|
hatchet Go pkg:golang/hatchet |
|
|
Fix
Source: OSV (GitHub advisory)
Fix available
Upgrade to 0.91.1 or later.
Patch commits
Merge commit from fork
+166 −5 across 2 files
- api/v1/server/authn/session_helpers.go+11 −5
- api/v1/server/authn/session_helpers_test.go+155 −0
Release commits
The commits each fixed release tag points at. They usually bump the version rather than contain the fix itself.
Vulnerability intelligence
Root cause analysis
Vulnerable functions
References
Advisories 4
Package 1
Credits
- manop55555reporter
Questions about CVE-2026-61687
- What is the GHSA ID for CVE-2026-61687?
- GitHub tracks CVE-2026-61687 as GHSA-phg3-3g28-wq9v.
- What is the CVSS score of CVE-2026-61687?
- CVE-2026-61687 has a CVSS 3.1 base score of 7.1 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.
- Which versions are affected by CVE-2026-61687?
- hatchet (Go): < 0.91.1.
- How do I fix CVE-2026-61687?
- Upgrade to 0.91.1 or later. The fix is in commit f904641.
- What is the Package URL (PURL) for CVE-2026-61687?
- The affected package's PURL is pkg:golang/hatchet.
- Is CVE-2026-61687 exploited in the wild?
- CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-61687. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none".
Data sources
Upstream records
- OSV (GitHub advisory)LoadedRaw JSON
- GitHub Advisory DatabaseLoadedRaw JSON
- OSV (CVE record)LoadedRaw JSON
- CVE.orgLoaded
- CISA KEV catalogLoaded
- FIRST EPSSUnavailable
Fetched 1 day ago (14 Oct 2026, 17:49 UTC). Records refresh automatically after 24 hours.
Where each part of this page came from
- Title and description
- OSV (GitHub advisory)
- Severity score
- GitHub Advisory Database
- Weakness (CWE)
- GitHub Advisory Database
- Affected packages
- OSV (GitHub advisory)
- Fix
- OSV (GitHub advisory)
- References
- Computed by CVEminer
- SSVC
- CVE.org
- KEV status
- CISA KEV catalog
OSV and GitHub Advisory Database content is licensed CC BY 4.0. Values marked as computed or derived were calculated by CVEminer from the upstream data.