Description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-09-21T16:17:09.997Z",
  "pubdate": "2026-09-21T16:17:09.997Z",
  "executiveSummary": "A session fixation vulnerability exists in the Hatchet platform prior to version 0.91.1 within the OAuth callback authentication flow.\nThe vulnerability occurs due to improper state validation where the application clears the oauth_state_ session variable upon validation but subsequently treats an empty state parameter as a successful match.\nThis flaw allows an unauthenticated attacker to bind a victim's active session to an attacker-controlled OAuth identity, effectively hijacking the user's authentication context.\nExploitation is contingent upon the victim having an existing, initiated OAuth flow session and the deployment having specific authentication providers enabled, such as Google, GitHub, or Slack.\nThe risk implication is significant as it facilitates unauthorized account access and potential cross-account identity impersonation.\nThe vulnerability is limited to deployments where external OAuth integrations are enabled and active.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the ValidateOAuthState function within the Hatchet authentication logic. During the OAuth callback process, the application is designed to verify the integrity of the request by comparing the state parameter provided in the callback URL against the value stored in the user's session (oauth_state_).\nIn versions prior to 0.91.1, the application logic prematurely clears the oauth_state_ session variable by setting it to an empty string immediately after the initial validation phase. However, the subsequent processing logic fails to enforce strict equality against a populated token. Instead, the function treats the now-empty session variable as a valid match for an empty state parameter provided by an attacker.\nAn attacker can exploit this by initiating their own OAuth flow and intercepting the callback process, or by crafting an OAuth callback request with an empty state parameter. If a victim has already initiated an OAuth flow in their browser session, the attacker can force the victim to complete the callback with the empty state, causing the application to associate the attacker's OAuth identity with the victim's established session state.\nThe attack flow follows these steps: 1) The victim starts an legitimate OAuth flow (e.g., via Google). 2) The attacker manipulates the victim's environment or provides a crafted link that triggers an empty state callback. 3) The ValidateOAuthState function clears the existing oauth_state_ session variable to an empty string. 4) The application compares the incoming empty state parameter against the cleared session variable. 5) Since both are null/empty, the validation logic incorrectly returns a success state. 6) The application proceeds to bind the user's session to the identity provided in the callback.\nThis vulnerability effectively bypasses the intended security protections of the OAuth state parameter, which is designed to prevent Cross-Site Request Forgery (CSRF) and session fixation attacks. The impact is a total compromise of the authentication binding, allowing the attacker to masquerade as the legitimate user within the Hatchet platform environment. The vulnerability affects all deployments where auth.google.enabled, auth.github.enabled, or the Slack integration are active."
}