CVE-2026-61687

Executive Summary

CVE-2026-61687 is an authentication bypass vulnerability in Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows. Prior to version 0.91.1, the ValidateOAuthState mechanism clears the oauth_state_ session value to an empty string after a successful OAuth callback and subsequently treats an empty state parameter as valid, enabling an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Deployments with Google OAuth, GitHub OAuth, or the Slack integration enabled are directly exposed, and successful exploitation yields high integrity impact to the victim's authenticated session.

Technical Analysis

The vulnerability resides in the OAuth state validation logic of Hatchet versions prior to 0.91.1. OAuth 2.0 relies on a state parameter as an anti-CSRF token that binds an authorization request to the user's session and must be validated on the callback. The described implementation flaw is twofold:

1. State destruction: After a successful OAuth callback is processed, ValidateOAuthState sets the oauth_state_ session value to an empty string. This removes the per-session nonce that would otherwise be required for a subsequent, distinct authorization response to be accepted.
2. Empty-state equivalence: The validation routine subsequently accepts an empty state parameter as equal to the stored (now empty) session value. Because an empty value is treated as a valid match, the anti-CSRF binding is effectively nullified for the remainder of that session.

This is an instance of CWE-287 (Improper Authentication). The practical consequence is a session-fixation / account-linking abuse primitive: an unauthenticated attacker can craft an OAuth authorization/callback flow whose state parameter is empty, causing the victim's Hatchet session to be bound to an OAuth identity controlled by the attacker. The root cause is insufficient validation of a security-relevant session token — specifically, failure to treat an empty or absent state as invalid, and failure to issue a fresh, non-reusable state token for each OAuth transaction.

The attack surface is the OAuth callback handling path of Hatchet. The NVD description explicitly names the ValidateOAuthState function, the oauth_state_ session value, the state parameter, and the configuration flags auth.google.enabled, auth.github.enabled, and the Slack integration. No further implementation details (routes, parameter names, or code snippets) are provided in the source data, and none are asserted here.

The exploitability prerequisites are notable:

• The victim must have completed an OAuth flow in the current session — i.e., the oauth_state_ value must already have been cleared to empty.
• The deployment must have OAuth enabled via Google, GitHub, or the Slack integration.

These prerequisites keep the CVSS attack complexity low but require user interaction (UI:R), as the victim must be induced to trigger or complete the flow. The vulnerability is unauthenticated from the attacker's perspective (PR:N) and remotely exploitable (AV:N).

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-61687. The attack chain below is inferred strictly from the vulnerability class (OAuth state validation bypass) and the specific behavior described in the NVD entry.

1. Reconnaissance / target identification. The attacker identifies a Hatchet deployment that has OAuth enabled (auth.google.enabled, auth.github.enabled, or the Slack integration). Such deployments expose an OAuth callback flow to the internet as part of the login/sign-up path.

2. Triggering the vulnerable state. The attacker initiates an OAuth authorization flow and ensures the victim's Hatchet session completes an OAuth callback first. After a successful callback, ValidateOAuthState clears oauth_state_ to an empty string in the victim's session. This satisfies the first precondition (the victim has completed an OAuth flow in the current session).

3. Submitting the empty state. The attacker causes the victim's browser/session to process an authorization response carrying an empty state parameter — an attacker-controlled OAuth identity's callback. Because the stored oauth_state_ is now empty and the validation logic treats an empty state as equal, the callback is accepted. The victim's Hatchet session is consequently linked or bound to the attacker-controlled OAuth identity.

4. Post-exploitation impact. The attacker gains an authenticated binding between the victim's Hatchet session and an identity the attacker controls. Per the CVSS vector, the dominant impact is Integrity: High (I:H), with limited Confidentiality: Low (C:L) and no Availability impact (A:N). In practical terms, the attacker can act under the victim's session context — e.g., viewing or manipulating the victim's workflows and orchestration state — and may persist access by re-authenticating through the attacker-controlled OAuth identity. The exact downstream capabilities depend on Hatchet's authorization model and are not specified in the source data.

The generic vulnerability-class trigger is a CSRF-style state bypass during OAuth account linking, where the absence of a valid state value is erroneously accepted. There is no evidence of exploit-in-the-wild, and no CISA KEV listing exists for this CVE.

Impact Assessment

Successful exploitation allows an unauthenticated remote attacker to bind a victim's authenticated Hatchet session to an attacker-controlled OAuth identity. The CVSS 3.1 base score is 7.1 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N.

Subscore interpretation:

• Attack Vector (Network): exploitable remotely over the internet.
• Attack Complexity (Low): no specialized conditions beyond the stated prerequisites.
• Privileges Required (None): the attacker needs no prior credentials.
• User Interaction (Required): the victim must have completed an OAuth flow in the current session.
• Scope (Unchanged): impact is confined to the vulnerable component.
• Confidentiality (Low): limited exposure of session-associated data.
• Integrity (High): the critical impact — unauthorized modification of the binding between session and identity.
• Availability (None): no denial-of-service effect.

Business impact centers on account/session takeover-adjacent abuse in workflow-orchestration environments. Hatchet orchestrates background tasks, AI agents, and durable workflows; a compromised session could expose or allow tampering with orchestration logic, schedules, and data passed through those workflows. Blast radius is limited to deployments with Google OAuth, GitHub OAuth, or the Slack integration enabled. The EPSS score is not yet available from FIRST.org, and no exploitation evidence exists as of this writing, so real-world risk currently rests on patch urgency rather than active campaigns.

Detection Guidance

Sigma Rule

title: Hatchet OAuth State Validation Bypass (CVE-2026-61687)
id: 8f3c2a91-7d4e-4b21-9c6a-hatchet001
status: experimental
description: Detects OAuth callback requests to Hatchet with an empty state parameter following an authentication flow, indicative of CVE-2026-61687 state-validation bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-61687
author: Valters IT Security
date: 2026-01-01
tags:
  - attack.initial-access
  - attack.t1190
  - cve.2026-61687
logsource:
  category: webserver
  product: generic
detection:
  selection_path:
    cs-uri-query|contains:
      - 'state='
      - 'code='
  selection_empty_state:
    cs-uri-query|contains:
      - '&state=&'
      - '?state=&'
  condition: selection_path and selection_empty_state
falsepositives:
  - Legitimate OAuth providers that omit state (not expected per spec)
level: high

YARA Rule

rule CVE_2026_61687_Hatchet_OAuth_State_Bypass
{
    meta:
        description = "Detects Hatchet source/config artifacts referencing the vulnerable OAuth state validation logic (CVE-2026-61687)"
        author = "Valters IT Security"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-61687"
        date = "2026-01-01"
        cve = "CVE-2026-61687"
    strings:
        $func = "ValidateOAuthState" ascii wide
        $sess = "oauth_state_" ascii wide
        $cfg1 = "auth.google.enabled" ascii wide
        $cfg2 = "auth.github.enabled" ascii wide
    condition:
        ($func and $sess) or ($sess and ($cfg1 or $cfg2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-61687 Hatchet OAuth State Validation Bypass - Empty State Parameter"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"state="; http.uri; content:"&state=&"; nocase; reference:cve,2026-61687; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-61687; classtype:attempted-user; sid:202661687; rev:1;)

Note: The above Suricata rule assumes the generic OAuth callback pattern; no Hatchet-specific URI path is disclosed in the source data.

Elastic Detection

network where network.protocol == "http" and
  url.query contains "state=" and
  (url.query contains "&state=&" or url.query contains "?state=&") and
  event.action == "network_flow"

Note: Detection is based on the generic empty-state OAuth callback pattern, since the callback path is not disclosed in the source data. Analysts should correlate with authentication events showing a Hatchet OAuth flow immediately preceding the empty-state request.

Splunk SPL Query

index=web OR index=proxy
| eval uri = coalesce(uri, url)
| where match(uri, "(?i)[?&]state=(&|$)")
| where match(uri, "(?i)(oauth|callback|auth)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, uri, user_agent
| where count >= 1
| table first_seen, last_seen, src_ip, uri, user_agent, count

Wazuh OSSEC Rule

<group name="web,hatchet,cve-2026-61687,">
  <rule id="202661" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>state=</url>
    <regex>oauth_state_|oauth</regex>
    <description>CVE-2026-61687: Possible Hatchet OAuth state validation bypass - empty state parameter in OAuth callback</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack.initial_access,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. The NVD description states the issue is fixed in version 0.91.1, but this has not been corroborated by any tracked patch source in this dataset. Treat all deployments below 0.91.1 as potentially vulnerable until vendor confirmation is verified.

1. Immediate mitigations

   • If OAuth is not required, disable auth.google.enabled, auth.github.enabled, and the Slack integration to remove the attack surface.
   • Restrict network access to Hatchet OAuth callback endpoints to trusted networks or authenticated reverse proxies where feasible.
   • Force session re-authentication and invalidate existing sessions on a regular basis to limit the window in which a bound attacker-controlled identity can persist.
   • Ensure any custom or downstream OAuth flows reject an empty or absent state parameter value.

2. Patch / upgrade steps

   • Upgrade Hatchet to version 0.91.1 or later, which the NVD description identifies as containing the fix.
   • Verify the installed version explicitly after upgrade and re-validate OAuth callback behavior with a test state parameter.
   • Until vendor confirmation is independently obtained, treat the fix as unverified and continue monitoring.

3. Long-term hardening

   • Enforce strict OAuth 2.0 state semantics: generate a cryptographically random, single-use state token per authorization request, bind it to the session, and invalidate it only after successful use — never set it to an empty string that is later treated as valid.
   • Reject empty, null, or missing state values without exception, and fail closed on validation errors.
   • Log and alert on OAuth callbacks with missing or empty state parameters.
   • Adopt account-linking re-authentication (step-up) so that binding an identity to an existing session requires the current session's credentials.
   • Track the CVE for vendor patch confirmation and add it to vulnerability-management workflows.

References

• NVD — CVE-2026-61687: https://nvd.nist.gov/vuln/detail/CVE-2026-61687
• CWE-287 — Improper Authentication: https://cwe.mitre.org/data/definitions/287.html
• OWASP — OAuth 2.0 Security Cheat Sheet (state parameter / CSRF): https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html
• FIRST.org — EPSS (score not yet assigned for CVE-2026-61687): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-61687 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild activity have been observed or reported for CVE-2026-61687 as of this writing.