{"id":"GHSA-phg3-3g28-wq9v","revision":"a6a1bca151b84d27bf67da41a122a3a1","records":[{"revision":"a6a1bca151b84d27bf67da41a122a3a1","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-phg3-3g28-wq9v","aliases":["CVE-2026-61687","GO-2026-6535"],"title":"Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState","description":"### Summary\n\nHatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation). \n\nThe vulnerable code clears the session `oauth_state_<integration>` value to the empty string `\"\"` after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty `?state=` parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF). \n\n\n### Impact\n\nAffected configurations: any deployment that has enabled at least one of `auth.google.enabled`, `auth.github.enabled`, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on `main` HEAD and in every tagged release up to and including v0.86.26 (commit `243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23`).","state":0,"publishedAt":"2026-09-21T15:47:01+00:00","modifiedAt":"2026-09-28T17:11:11.519742+00:00","affected":[{"ecosystem":"Go","name":"hatchet","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.91.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v","https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428","https://github.com/hatchet-dev/hatchet"],"sourceUrl":"https://github.com/advisories/GHSA-phg3-3g28-wq9v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-phg3-3g28-wq9v","identifiers":["GHSA-phg3-3g28-wq9v","CVE-2026-61687","GO-2026-6535"]},"retained":false,"historicalAffected":[]}],"coverage":[]}