What happened
Published 2026-09-21. Because the empty-string state is accepted as a match after the OAuth callback, an attacker can attach a victim's session to an attacker-chosen OAuth identity — an OAuth state-integrity flaw with session-binding consequences (CWE-287/352/384/1275).
Why it matters
Hatchet runs background tasks and durable AI-agent workflows; hijacking an orchestration identity lets an attacker re-route, trigger or observe agent executions and their workflow state, undermining the agent control plane.
Attack vector
ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal. An unauthenticated attacker who can get a victim to be mid-OAuth-flow in their session can bind the victim's Hatchet session to an attacker-controlled OAuth identity, hijacking an agent/orchestrator account.
Affected systems
Hatchet < 0.91.1
Mitigation
Upgrade to Hatchet v0.91.1 (commit f9046418; GHSA-phg3-3g28-wq9v).