CVE-2026-61687

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation).

The vulnerable code clears the session oauth_state_<integration> value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty ?state= parameter on any later callback request, allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF).

Affected configurations: any deployment that has enabled at least one of auth.google.enabled, auth.github.enabled, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on main HEAD and in every tagged release up to and including v0.86.26 (commit 243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23).

The application does not adequately verify the identity of a user, device, or process before granting access. Typical impact: unauthorized access to functions or data reserved for authenticated parties.

CVE-2026-61687 has a CVSS score of 7.1 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.91.1); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2026-61687? CVE-2026-61687 is a high-severity improper authentication vulnerability in hatchet (go), affecting versions < 0.91.1. It is fixed in 0.91.1. The application does not adequately verify the identity of a user, device, or process before granting access.
2. How severe is CVE-2026-61687? CVE-2026-61687 has a CVSS score of 7.1 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of hatchet are affected by CVE-2026-61687? hatchet (go) versions < 0.91.1 is affected.
4. Is there a fix for CVE-2026-61687? Yes. CVE-2026-61687 is fixed in 0.91.1. Upgrade to this version or later.
5. Is CVE-2026-61687 exploitable, and should I be worried? Whether CVE-2026-61687 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-61687 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-61687? Upgrade hatchet to 0.91.1 or later.