CVE-2026-61687: Hatchet OAuth State Auth Bypass Vulnerability

CVE-2026-61687 Overview

CVE-2026-61687 is an authentication bypass vulnerability in Hatchet, an open-source platform for orchestrating background tasks, AI agents, and durable workflows. Versions prior to 0.91.1 contain a flaw in the ValidateOAuthState function that clears the oauth_state_ session value to an empty string after a successful OAuth callback. The function later accepts an empty state parameter as equal, enabling an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. The issue is tracked under [CWE-287] Improper Authentication.

Critical Impact
An attacker can hijack a victim's authenticated Hatchet session and bind it to an attacker-controlled OAuth identity, gaining persistent access to the victim's workflows and data.

Affected Products

Hatchet versions prior to 0.91.1
Deployments with auth.google.enabled configured
Deployments with auth.github.enabled or the Slack integration enabled

Discovery Timeline

2026-09-21 - CVE-2026-61687 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-61687

Vulnerability Analysis

The vulnerability resides in Hatchet's OAuth state validation logic within api/v1/server/authn/session_helpers.go. OAuth state parameters exist to bind a specific browser session to an in-flight OAuth authorization request, preventing cross-session identity injection. In vulnerable releases, ValidateOAuthState clears the stored oauth_state_ session value to an empty string immediately after a successful callback validation.

On subsequent OAuth callbacks reusing the same session, the comparison logic treats the cleared empty stored state as equal to an empty state parameter supplied by an attacker. This effectively short-circuits state validation and allows an attacker-controlled OAuth callback to complete against the victim's session context.

Successful exploitation binds the victim's authenticated Hatchet session to the attacker's OAuth identity (Google, GitHub, or Slack). The attacker then authenticates as that identity and inherits the victim's session context, gaining access to Hatchet workflows, tenants, and orchestration data associated with that session.

Root Cause

The root cause is insecure state handling combined with a permissive equality check. Clearing the session state to an empty string after validation, rather than removing the key entirely or rotating it, creates an ambiguous condition. The subsequent comparison does not reject empty values before checking equality, so "" == "" passes validation. The upstream patch introduces constant-time comparison via the crypto/subtle package and rejects empty state values.

Attack Vector

Exploitation requires user interaction and specific preconditions. The victim must have completed at least one OAuth flow in the current session, and the deployment must have auth.google.enabled, auth.github.enabled, or the Slack integration enabled. The attacker crafts an OAuth callback URL containing their own authorization code and an empty state parameter, then induces the victim to visit it. When the victim's browser submits the callback, Hatchet validates the empty state against the cleared session value and binds the attacker's OAuth identity to the victim's session.

 package authn
 
 import (
+	"crypto/subtle"
 	"fmt"
 	"net/http"

Source: Hatchet security patch commit f9046418 — the fix imports crypto/subtle to introduce constant-time state comparison and reject empty values.

Detection Methods for CVE-2026-61687

Indicators of Compromise

OAuth callback requests to Hatchet endpoints containing an empty or missing state query parameter.
Multiple successful OAuth callbacks tied to the same session identifier within a short time window.
Audit log entries showing an existing user session suddenly associated with a new external OAuth identity (Google, GitHub, or Slack).

Detection Strategies

Inspect Hatchet API access logs for /auth/*/callback requests with state= empty or absent, and correlate with the source IP of the initiating login.
Alert when an authenticated session's linked OAuth identity changes without a corresponding account settings action.
Compare the OAuth identity provider account bound to a session against historical bindings for that user to identify anomalous re-bindings.

Monitoring Recommendations

Enable verbose logging on the Hatchet authentication subsystem to capture state parameter values and session identifiers during OAuth flows.
Forward Hatchet authentication events to a centralized SIEM or data lake for cross-session correlation and long-term retention.
Monitor for unexpected outbound OAuth callback traffic to Google, GitHub, or Slack originating from Hatchet users outside their normal patterns.

How to Mitigate CVE-2026-61687

Immediate Actions Required

Upgrade Hatchet to version 0.91.1 or later, which contains the fixed ValidateOAuthState implementation.
Invalidate all active user sessions after upgrading to force re-authentication and clear any potentially compromised session-to-identity bindings.
Audit all OAuth identity bindings on user accounts and revoke any that appear anomalous or unauthorized.

Patch Information

The fix is available in Hatchet version 0.91.1. The upstream patch imports Go's crypto/subtle package to perform constant-time comparison of OAuth state values and explicitly rejects empty state parameters. Full details are available in the GitHub Security Advisory GHSA-phg3-3g28-wq9v and the remediation commit.

Workarounds

If immediate upgrade is not possible, disable auth.google.enabled, auth.github.enabled, and the Slack integration in the Hatchet deployment configuration until the patch can be applied.
Require users to fully log out and clear session cookies after any OAuth-linked activity to shorten the window in which the cleared state condition can be abused.
Place Hatchet behind a reverse proxy that rejects OAuth callback requests with empty or missing state parameters at the edge.

bash

# Upgrade Hatchet to the patched release
helm repo update
helm upgrade hatchet hatchet/hatchet --version 0.91.1

# Or pin the container image tag
docker pull ghcr.io/hatchet-dev/hatchet:v0.91.1