# CVE-2026-61687: Hatchet OAuth state CSRF via empty-state collision

Source: https://junglewise.ai/threats/cve-2026-61687-hatchet-oauth-state-csrf-via-empty-state-collision  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61687 · Severity: high · CVSS 7.1 · Published 2026-09-21

Hatchet is a task orchestration and scheduling platform that supports OAuth-based login via Google, GitHub, and Slack. An unauthenticated attacker can exploit a flaw in session state validation to bind a victim's authenticated session to an attacker-controlled OAuth account, effectively taking over the victim's account without needing to compromise their password or MFA.

Technologies: [github.com/hatchet-dev/hatchet (Go)](https://junglewise.ai/threats/technologies/github-com-hatchet-dev-hatchet), [Hatchet](https://junglewise.ai/threats/technologies/hatchet). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Hatchet](https://junglewise.ai/threats/vendors/hatchet).

## Quick answers

**Is CVE-2026-61687 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61687 being exploited in the wild.

**How severe is CVE-2026-61687?** High severity, with a CVSS score of 7.1, published 21 September 2026.

**Which products and versions are affected?** github.com/hatchet-dev/hatchet (Go) SEMVER:introduced=0; hatchet (Go) SEMVER:introduced=0,fixed=0.91.1; Hatchet < 0.91.1.

**Is there a fix for CVE-2026-61687?** Yes. hatchet (Go): upgrade to 0.91.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61687 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61687?** Check whether you run github.com/hatchet-dev/hatchet (Go), hatchet (Go) or Hatchet at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- hatchet (Go): upgrade to 0.91.1 or later

  ```sh
  go get hatchet@v0.91.1
  ```


## Technical details

This vulnerability is a session fixation and OAuth state CSRF vulnerability (CWE-287, CWE-352, CWE-384) in the ValidateOAuthState function. The vulnerable code clears the session `oauth_state_<integration>` variable to an empty string `""` after a successful OAuth callback, rather than removing the key entirely. Later, during state validation, the code accepts an empty `?state=` parameter as valid, allowing an unauthenticated attacker to craft a malicious OAuth callback URL with `state=` that matches the empty session value. If a victim with an existing authenticated session visits this link, the attacker's OAuth identity binds to the victim's session cookie. The attack requires user interaction (victim must click a link) and affects deployments with Google, GitHub, or Slack OAuth enabled. Patch is available in version 0.91.1 and later.

## Affected products

- Hatchet Hatchet < 0.91.1

## Identifiers

- CVE-2026-61687
- GHSA-phg3-3g28-wq9v
- GO-2026-6535

## Timeline

- 2026-09-21: disclosed: Published to GitHub Advisory Database
- 2026-09-21: patched: Fix available in version 0.91.1

## References

- [https://api.github.com/users/manop55555](https://api.github.com/users/manop55555)

## Related threats

- [Hatchet resource exhaustion via SNS ingestion endpoint](https://junglewise.ai/threats/cve-2026-108755-hatchet-through-0-110-5-contains-an-allocation-of-resources)
- [Hatchet DurableTask WorkerStatus gRPC authorization bypass via unfiltered tenant_id](https://junglewise.ai/threats/cve-2026-88978-hatchet-durabletask-workerstatus-grpc-authorization-bypass-via)
- [Hatchet cross-tenant durable callback payload disclosure](https://junglewise.ai/threats/cve-2026-84298-hatchet-cross-tenant-durable-callback-payload-disclosure)
- [Hatchet authorization bypass in durable task event log endpoint](https://junglewise.ai/threats/cve-2026-63342-hatchet-authorization-bypass-in-durable-task-event-log-endpoint)
- [Hatchet SSRF in SNS UnsubscribeConfirmation handler](https://junglewise.ai/threats/cve-2026-61681-hatchet-ssrf-in-sns-unsubscribeconfirmation-handler)