The vulnerability arises from the ValidateOAuthState function in Hatchet’s authentication flow. After a successful OAuth callback, the function clears the oauth_state_ session value to an empty string, then later accepts an empty state parameter as equal to the cleared value. Because the state parameter is not regenerated per request, an unauthenticated attacker can perform an empty-state collision, causing the victim’s Hatchet session to be linked to the attacker’s OAuth identity. This binding effectively lets the attacker impersonate the victim within Hatchet, granting unauthorized access to all resources and actions the victim can perform.

Hatchet’s open‑source platform, developed by hatchet-dev, is affected in all releases prior to 0.91.1. The issue exists when deployment enables any of the OAuth integrations listed: Google, GitHub, or Slack. The fix was delivered in release 0.91.1, which enforces proper state handling and disallows empty state collisions. Therefore, any deployment running a pre‑0.91.1 version with an active OAuth integration is vulnerable.

The CVSS score of 7.1 indicates a high severity, and the vulnerability is not listed in the CISA KEV catalog. EPSS data is not available, so the current exploitation probability is unknown. The attack requires the victim to have completed an OAuth flow in the current session, making the attack possible only during an active user session, but once achieved, it provides the attacker with full account access. Given the potential impact and the lack of a mitigation in user‑controlled environments, the risk remains high until the vendor releases a patch.