CVE-2026-61687: OAuth State Validation Bypass and Login CSRF in Hatchet
Vulnerability ID: CVE-2026-61687
CVSS Score: 7.1
Published: 2026-09-21
A logic error in Hatchet's OAuth state validation mechanism allows unauthenticated remote attackers to bypass state parameter verification. By submitting an empty state parameter, attackers can exploit an equality collision with cleared session keys, facilitating Login Cross-Site Request Forgery (Login CSRF) or Session Fixation.
TL;DR
A session validation flaw in Hatchet allows attackers to bypass OAuth state verification using empty parameters, enabling Login CSRF and unauthorized account association.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-384, CWE-352, CWE-287
- Attack Vector: Network (AV:N)
- CVSS v3.1 Score: 7.1 (High)
- Exploit Status: poc
- CISA KEV Status: Not Listed
Affected Systems
- Hatchet background task orchestration platform
-
Hatchet: < 0.91.1 (Fixed in:
0.91.1)
Code Analysis
Commit: f904641
Fix OAuth state validation bypass vulnerability in session_helpers.go
Exploit Details
- GitHub: Integration test validating the empty-state comparison bypass condition in the session helpers suite
Mitigation Strategies
- Upgrade Hatchet to version 0.91.1 or higher
- Implement virtual patching at the reverse proxy or WAF layer to drop callback requests with empty state parameters
- Temporarily disable third-party OAuth integrations if upgrading is delayed
Remediation Steps:
- Identify the current running version of Hatchet in your infrastructure.
- Update deployment configurations to pull image tag 'v0.91.1' or newer.
- Apply the configuration change to restart the Hatchet server pods or containers.
- Verify the fix by attempting to invoke the callback endpoint with an empty state parameter, ensuring a 400/500 level error is returned.
References
Read the full report for CVE-2026-61687 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)