{"data":{"id":"af8fddf9-71c8-4035-bbe3-9c8d29b98c3a","title":"CVE-2026-61687: Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1…","summary":"CVE-2026-61687 affects Hatchet, a platform for orchestrating background tasks, AI agents, and durable workflows, in versions prior to 0.91.1. ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback, then accepts an empty state parameter as equal, letting an unauthenticated attacker bind a victim's session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and auth.google.enabled, auth.github.enabled, or the Slack integration to be enabled.","solution":"Fixed in version 0.91.1.","labels":["security"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-61687","publishedAt":"2026-09-21T16:17:09.997Z","cveId":"CVE-2026-61687","cweIds":["CWE-287","CWE-352","CWE-384","CWE-1275"],"cvssScore":"7.1","cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["hatchet@< 0.91.1 (fixed: 0.91.1)"],"affectedPackageNames":["hatchet"],"affectedPackageRefs":["go:hatchet"],"affectedVendors":[],"affectedVendorsRaw":["Hatchet"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":"Hatchet OAuth state validation flaw allows session binding to attacker identity","headlinePromptVersion":"h1","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","attackVector":"network","attackComplexity":"low","privilegesRequired":"none","userInteraction":"required","exploitMaturity":"unknown","epssScore":0.00171,"epssCheckedAt":"2026-11-10T00:11:22.330Z","kevDateAdded":null,"advisoryAliases":["GHSA-phg3-3g28-wq9v"],"affectedPackagesSource":"ghsa","affectedPackagesCheckedAt":"2026-10-10T03:43:28.043Z","patchAvailable":true,"disclosureDate":"2026-09-21T16:17:09.997Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":"2026-11-06T00:07:39.311Z","capecIds":["CAPEC-114"],"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"agent","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"go","name":"hatchet","fixedVersion":"0.91.1","matchedVersion":null,"fixReleasedAt":null,"daysToFix":null,"match":"ecosystem","source":null,"status":"package_not_found","checkedAt":"2026-11-06T00:07:39.308Z"}]}}