Executive brief
Hatchet is a task orchestration and scheduling platform that supports OAuth-based login via Google, GitHub, and Slack. An unauthenticated attacker can exploit a flaw in session state validation to bind a victim's authenticated session to an attacker-controlled OAuth account, effectively taking over the victim's account without needing to compromise their password or MFA.
Technical details
This vulnerability is a session fixation and OAuth state CSRF vulnerability (CWE-287, CWE-352, CWE-384) in the ValidateOAuthState function. The vulnerable code clears the session `oauth_state_<integration>` variable to an empty string `""` after a successful OAuth callback, rather than removing the key entirely. Later, during state validation, the code accepts an empty `?state=` parameter as valid, allowing an unauthenticated attacker to craft a malicious OAuth callback URL with `state=` that matches the empty session value. If a victim with an existing authenticated session visits this link, the attacker's OAuth identity binds to the victim's session cookie. The attack requires user interaction (victim must click a link) and affects deployments with Google, GitHub, or Slack OAuth enabled. Patch is available in version 0.91.1 and later.
Affected products
- Hatchet Hatchet < 0.91.1
Timeline
- 2026-09-21: disclosed: Published to GitHub Advisory Database
- 2026-09-21: patched: Fix available in version 0.91.1