{"vulnerability": "cve-2026-61687", "sightings": [{"uuid": "ced7729b-ba83-42ba-b580-940b075616d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61687", "type": "seen", "source": "https://gist.github.com/alon710/cd3d4f295cb3f81bbf208f1f924aafe9", "content": "# CVE-2026-61687: CVE-2026-61687: OAuth State Validation Bypass and Login CSRF in Hatchet\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-09-21\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61687\n\n## Summary\nA logic error in Hatchet's OAuth state validation mechanism allows unauthenticated remote attackers to bypass state parameter verification. By submitting an empty state parameter, attackers can exploit an equality collision with cleared session keys, facilitating Login Cross-Site Request Forgery (Login CSRF) or Session Fixation.\n\n## TL;DR\nA session validation flaw in Hatchet allows attackers to bypass OAuth state verification using empty parameters, enabling Login CSRF and unauthorized account association.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-384, CWE-352, CWE-287\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 7.1 (High)\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Hatchet background task orchestration platform\n- **Hatchet**: < 0.91.1 (Fixed in: `0.91.1`)\n\n## Mitigation\n\n- Upgrade Hatchet to version 0.91.1 or higher\n- Implement virtual patching at the reverse proxy or WAF layer to drop callback requests with empty state parameters\n- Temporarily disable third-party OAuth integrations if upgrading is delayed\n\n**Remediation Steps:**\n1. Identify the current running version of Hatchet in your infrastructure.\n2. Update deployment configurations to pull image tag 'v0.91.1' or newer.\n3. Apply the configuration change to restart the Hatchet server pods or containers.\n4. Verify the fix by attempting to invoke the callback endpoint with an empty state parameter, ensuring a 400/500 level error is returned.\n\n## References\n\n- [GitHub Security Advisory GHSA-phg3-3g28-wq9v](https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-phg3-3g28-wq9v)\n- [Fix Commit f904641](https://github.com/hatchet-dev/hatchet/commit/f90464189ad642251e09412d0f99fde353036428)\n- [CVE-2026-61687 Record](https://www.cve.org/CVERecord?id=CVE-2026-61687)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61687) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-21T16:31:47.593954Z"}]}