# CVE-2026-61687: Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

> CVE-2026-61687 (GitHub advisory GHSA-phg3-3g28-wq9v) is a high-severity vulnerability with a CVSS 3.1 base score of 7.1, classed as Improper Authentication (CWE-287), in hatchet (Go). Affected versions: < 0.91.1. It is fixed in 0.91.1.

Canonical page: https://cveminer.com/vulnerabilities/CVE-2026-61687

| Field | Value |
| --- | --- |
| CVE | CVE-2026-61687 |
| GHSA | GHSA-phg3-3g28-wq9v |
| Severity | High |
| CVSS 3.1 | 7.1 `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N` (GitHub Advisory Database) |
| CWE | CWE-287 Improper Authentication; CWE-352 Cross-Site Request Forgery (CSRF); CWE-384 Session Fixation; CWE-1275 Sensitive Cookie with Improper SameSite Attribute |
| CISA KEV | Not listed |
| SSVC | exploitation none, automatable no, technical impact partial |
| Published | 21 Sept 2026 |
| Modified | 21 Sept 2026 |

## Description

Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation). 

The vulnerable code clears the session `oauth_state_<integration>` value to the empty string `""` after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty `?state=` parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF). 


##### Impact

Affected configurations: any deployment that has enabled at least one of `auth.google.enabled`, `auth.github.enabled`, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on `main` HEAD and in every tagged release up to and including v0.86.26 (commit `243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23`).

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| hatchet | Go | `pkg:golang/hatchet` | < 0.91.1 | 0.91.1 |

## Fix commits

- Patch: https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428
- Release: https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb (0.91.1)

## Questions

**What is the GHSA ID for CVE-2026-61687?**

GitHub tracks CVE-2026-61687 as GHSA-phg3-3g28-wq9v.

**What is the CVSS score of CVE-2026-61687?**

CVE-2026-61687 has a CVSS 3.1 base score of 7.1 (High), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.

**Which versions are affected by CVE-2026-61687?**

hatchet (Go): < 0.91.1.

**How do I fix CVE-2026-61687?**

Upgrade to 0.91.1 or later. The fix is in commit f904641.

**What is the Package URL (PURL) for CVE-2026-61687?**

The affected package's PURL is pkg:golang/hatchet.

**Is CVE-2026-61687 exploited in the wild?**

CISA's Known Exploited Vulnerabilities catalog doesn't list CVE-2026-61687. That means no confirmed exploitation has been catalogued, not that it is safe to leave unpatched. CISA's SSVC assessment rates exploitation as "none".

## References

- https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428 (fix)
- https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v (advisory)
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61687.json (advisory)
- https://nvd.nist.gov/vuln/detail/CVE-2026-61687 (advisory)
- https://github.com/advisories/GHSA-phg3-3g28-wq9v (advisory)
- https://github.com/hatchet-dev/hatchet (package)

---

Source: CVEminer (https://cveminer.com/vulnerabilities/CVE-2026-61687), compiled from OSV (GitHub advisory), GitHub Advisory Database, OSV (CVE record), CVE.org, CISA KEV catalog. OSV and GitHub Advisory Database content is licensed CC BY 4.0.