Hatchet OAuth State Reuse Enables Session-to-Identity Rebinding

Technical Analysis

The vulnerability lies in ValidateOAuthState, which clears the oauth_state_ session value to an empty string after a successful callback but then treats a subsequently-empty state parameter as a valid match rather than rejecting it. An attacker can leverage this by inducing a victim (whose session already completed one OAuth login) to complete an OAuth callback with an empty or attacker-supplied state, causing the victim's session to become bound to an OAuth identity the attacker controls, such as an attacker's Slack, GitHub, or Google account tied to the Hatchet task orchestration platform. Because Hatchet is used to orchestrate AI agents and durable workflows, this identity confusion could let an attacker gain access to or impersonate within workflows/agents tied to the victim's session, crossing from a web authentication flaw into agent-execution context trust. The attack requires no prior authentication by the attacker, only that the targeted deployment has one of the OAuth providers enabled and that the victim previously completed a legitimate OAuth flow.

Affected Systems

Hatchet; protocols: OAuth 2.0

Detection Signatures

• OAuth callback requests where the state parameter is empty or missing but still accepted
• Repeated OAuth callback attempts against active/pre-authenticated sessions
• Session identity changes (oauth account linkage change) without a corresponding logout/login event
• Anomalous binding of a session to a new external OAuth identity mid-session
• Log entries showing oauth_state_ session value as empty string paired with successful ValidateOAuthState result

Remediation Steps

1. 1

   Upgrade Hatchet

   Update to Hatchet version 0.91.1 or later, which fixes the ValidateOAuthState empty-state acceptance bug.

2. 2

   Reject empty OAuth state values

   Ensure OAuth state validation explicitly rejects empty, null, or missing state parameters rather than treating them as equal to a cleared value.

3. 3

   Regenerate state per authorization request

   Generate a fresh, unpredictable state value for every OAuth authorization request and invalidate it immediately after single use, never reusing or clearing to an empty string that could match future requests.

4. 4

   Session re-authentication on identity binding

   Require full re-authentication or step-up verification before allowing a session to bind to a new external identity provider account.

5. 5

   Audit OAuth-linked sessions

   Review logs for sessions with unexpected mid-session identity relinking events prior to patching, especially for Google, GitHub, and Slack integrations.