CVE-2026-61687

Hatchet OAuth state CSRF / login-CSRF. CVE-2026-61687: empty-state collision in ValidateOAuthState enables unauthenticated OAuth state CSRF. Another auth-boundary issue in a workflow/orchestration-style service. Worth a look if the product is in your stack. https://vulnso.com/vuln/hatchet-unauthenticated-oauth-state-csrf-login-csrf-via-empty-state-collision-in-validateoauthstate #Cybersecurity #AI #AISecurity #MCP #Claude #GPT #Infosec #Trending #AppSec #AuthBypass

OAuth 明明校验了 state，还能被空字符串绕过接管账号？这篇 Hatchet 漏洞分析可以看看。 它讲的是 CVE-2026-61687，Hatchet v0.86.26 及以下版本的 OAuth state CSRF，回调后把 session 值清成空字符串而不是删 key，导致空的 ?state= 也能通过校验。 1️⃣ 根因很离谱：验证完不删 key 只置空，直接制造了空对空的碰撞通过。 2️⃣ 前提很常见：开了谷歌、GitHub 或 Slack 任一集成，且受害者本会话做过一次授权就行。 3️⃣ 打法是登录 CSRF：攻击者无需登录，就能把受害者会话绑到攻击者的 OAuth 身份上接管。 4️⃣ 影响不小：CVSS 7.1，覆盖历史上所有 tagged 版本，修复在 0.91.1。 一句话：state 用完必须一次性作废并删掉，置空就等于留了个万能钥匙。 https://www.reddit.com/r/cybersecurity/comments/1wn16el/hatchet_oauth_state_csrf_cve202661687/ https://vulnso.com/vuln/hatchet-unauthenticated-oauth-state-csrf-login-csrf-via-empty-state-collision-in-validateoauthstate

Think clearing a session value to "" is the same as deleting it? This Hatchet OAuth bug proves it isn't. Reddit's r/cybersecurity flagged CVE-2026-61687: an unauthenticated OAuth state CSRF / login-CSRF in Hatchet up to v0.86.26 that lets an attacker hijack a victim session by binding it to an attacker-owned OAuth identity. 1️⃣ After a legit OAuth callback, Hatchet blanked oauth_state_<integration> to "" instead of deleting the key. 2️⃣ The next callback then compared ?state= against "" — so an empty state param passed validation. 3️⃣ Attacker just lures an authenticated victim who already did OAuth in that session to open a crafted callback with empty state. 4️⃣ Victim's session gets fixed to the attacker's Google / GitHub / Slack identity = account takeover, CVSS 7.1. 5️⃣ Fix is upgrade to 0.91.1 and rotate sessions if you ran Google, GitHub auth or Slack integration. Bottom line: Never validate secrets with empty-equals-empty — delete the state, don't blank it. https://www.reddit.com/r/cybersecurity/comments/1wn16el/hatchet_oauth_state_csrf_cve202661687/ https://vulnso.com/vuln/hatchet-unauthenticated-oauth-state-csrf-login-csrf-via-empty-state-collision-in-validateoauthstate