HIGH7.1
GO-2026-6535
Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet
Quick fix
GO-2026-6535 — github.com/hatchet-dev/hatchet: upgrade to the fixed version with the command below.
go get github.com/hatchet-dev/hatchet@v0.91.2Details
Unauthenticated OAuth state CSRF via empty-state collision in ValidateOAuthState in github.com/hatchet-dev/hatchet
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/hatchet-dev/hatchet
Introduced in:
0Fixed in: 0.91.2Fix
go get github.com/hatchet-dev/hatchet@v0.91.2