{"id":"GO-2026-6535","revision":"30ac79755ddb49d2b98b6a5cd6d6f1f3","records":[{"revision":"30ac79755ddb49d2b98b6a5cd6d6f1f3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6535","aliases":["CVE-2026-61687","GHSA-phg3-3g28-wq9v"],"title":"Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet","description":"Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet","state":0,"publishedAt":"2026-09-28T16:43:40+00:00","modifiedAt":"2026-10-07T17:45:12.9758115+00:00","affected":[{"ecosystem":"Go","name":"github.com/hatchet-dev/hatchet","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.91.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v","https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6535","license":"OSV · upstream source license applies","key":"osv:GO-2026-6535","identifiers":["GO-2026-6535","CVE-2026-61687","GHSA-phg3-3g28-wq9v"]},"retained":false,"historicalAffected":[]}],"coverage":[]}