GHSA-phg3-3g28-wq9v
Suggest an improvement- Source
- https://github.com/advisories/GHSA-phg3-3g28-wq9v
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-phg3-3g28-wq9v/GHSA-phg3-3g28-wq9v.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-phg3-3g28-wq9v
- Aliases
- Published
- 2026-09-21T15:47:01Z
- Modified
- 2026-09-21T16:00:07Z
- Severity
-
- 7.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N CVSS Calculator
- Summary
- Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState
- Details
-
Summary
Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation).
The vulnerable code clears the session
oauth_state_<integration>value to the empty string""after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty?state=parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim's session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF).Impact
Affected configurations: any deployment that has enabled at least one of
auth.google.enabled,auth.github.enabled, or the Slack integration, and where the victim has completed at least one OAuth flow on that integration in the current session. Bug present onmainHEAD and in every tagged release up to and including v0.86.26 (commit243f41d9e1161e70d47dfc0a6509f1c4ddfc9c23). - Database specific
{ "cwe_ids": [ "CWE-1275", "CWE-287", "CWE-352", "CWE-384" ], "github_reviewed": true, "github_reviewed_at": "2026-09-21T15:47:01Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
Go / hatchet
Package
- Name
- hatchet
- View open source insights on deps.dev
- Purl
- pkg:golang/hatchet