Skip to content
OpenAdvisories

Vendor

hatchet-dev

8 known vulnerabilities.

Products

hatchet 8
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-61687

    hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty stat…

    hatchet-dev hatchet github.com/hatchet-dev/hatchet Go