Unauthenticated OAuth State CSRF Vulnerability in Hatchet

Executive Summary

A critical vulnerability was discovered in Hatchet versions v0.86.26 and below, affecting the OAuth state validation mechanism. This flaw enables an unauthenticated attacker to perform a login CSRF (Cross-Site Request Forgery) attack, potentially resulting in account takeover.

Technical Analysis

The vulnerability is caused by the improper handling of OAuth state parameters in the `ValidateOAuthState` function. Specifically, the code clears the session `oauth_state_` value to an empty string after a successful OAuth callback, rather than removing the key. This allows an attacker to provide an empty `?state=` parameter on any later callback request, effectively bypassing the state-equality check. The vulnerability falls under the following CWE categories: - CWE-287: Improper Authentication - CWE-352: Cross-Site Request Forgery (CSRF) - CWE-384: Session Fixation - CWE-1275: Sensitive Cookie with Improper SameSite Attribute

How It Gets Exploited

An unauthenticated attacker can exploit this vulnerability as follows: - The attacker identifies a victim who has an active session with Hatchet and has completed at least one OAuth flow. - The attacker crafts a malicious OAuth callback request with an empty `?state=` parameter. - The victim, still authenticated, is tricked into making this request (e.g., via a phishing link or social engineering). - The Hatchet application, due to its flawed state validation, accepts this request and binds the victim's session cookie to the attacker's OAuth identity. - The attacker can now access the victim's account, effectively achieving an account takeover.

Impact Assessment

The vulnerability affects Hatchet deployments with at least one of the following integrations enabled: `auth.google.enabled`, `auth.github.enabled`, or Slack integration, where the victim has completed at least one OAuth flow in the current session. The vulnerability is present in all tagged releases up to and including v0.86.26. The CVSS score for this vulnerability is 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N).

Recommended Actions

To mitigate this vulnerability, Hatchet users should update to version 0.91.1 or later. Additionally, the following measures are recommended: - Implement proper input validation for OAuth state parameters. - Ensure that session management is handled securely, with proper removal of OAuth state values after use. - Monitor for suspicious OAuth callback requests and implement rate limiting where possible.

Sources

- GitHub Security Advisories: GHSA-phg3-3g28-wq9v - NVD: CVE-2026-61687