CVE-2026-61687: hatchet-dev hatchet Improper Authentication

Vulnerability summary

CVE-2026-61687 is a high (CVSS 7.1) Improper Authentication vulnerability in hatchet-dev hatchet. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.1% of scored vulnerabilities.

Timeline

1. 21-09-2026
   PublishedVulnerability first disclosed.
2. 21-09-2026
   Last modifiedVulnerability information updated.

Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

• CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.
• CWE-384Session FixationAuthenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
• CWE-1275Sensitive Cookie with Improper SameSite AttributeThe SameSite attribute for sensitive cookies is not set, or an insecure value is used.