CVE-2026-61687

2 advisories.

Go/hatchet CVE-2026-61687: high 7.1, EPSS 0.17%

Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Action: Upgrade hatchet to 0.91.1 or later.

go get hatchet@v0.91.1

Affected

introduced	fixed	last affected
0	0.91.1	-

Fixed versions

0.91.1

Sources

CVE-2026-61687 · published 2026-09-21T15:47:01Z · modified 2026-09-28T17:11:11.519741965Z · JSON

Go/github.com/hatchet-dev/hatchet CVE-2026-61687: unknown, EPSS 0.17%

Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet

Action: Upgrade github.com/hatchet-dev/hatchet to 0.91.2 or later.

go get github.com/hatchet-dev/hatchet@v0.91.2

Affected

introduced	fixed	last affected
0	0.91.2	-

Fixed versions

0.91.2

Sources

CVE-2026-61687 · published 2026-09-28T16:43:40Z · modified 2026-10-07T17:45:12.975811531Z · JSON