Skip to content
OpenAdvisories

Package · Go

github.com/hatchet-dev/hatchet

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-61687

    hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty stat…

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go