Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
### Summary Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation). The vulnerable code clears the session `oauth_state_` value to the empty string `""` after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty `?state=` parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF). ### Impact Affected configurations: any deployment that has enabled at least one of `auth.google.enabled`, `auth.github.enabled`, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present on `main` HEAD and in every tagged release up to and including v0.86.26 (commit `243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23`).
GHSA-phg3-3g28-wq9v
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-phg3-3g28-wq9v
hatchet
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 0.91.1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.91.1"
}
]
}
],
"package": {
"name": "hatchet",
"purl": "pkg:golang/hatchet",
"ecosystem": "Go"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-phg3-3g28-wq9v/GHSA-phg3-3g28-wq9v.json"
}
}
]- Related CVEs
- CVE-2026-61687
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #23413 · Revision 1
- Added to Heist Feed
- Publisher date