CVE-2026-61687

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1

Description A flaw in the ValidateOAuthState function allows an unauthenticated attacker to bind a victim's session to an attacker-controlled OAuth identity. This occurs because the system clears the oauth state session value to an empty string after a successful OAuth callback instead of removing the key entirely. Consequently, subsequent state-equality checks accept an empty state parameter. This issue, known as login CSRF or account fixation, requires the deployment to have auth.google.enabled, auth.github.enabled, or the Slack integration enabled, and for the victim to have completed an OAuth flow in the current session.

Recommendations Update to version 0.91.1.