Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-61687, in Hatchet (versions v0.86.26 and below) is an unauthenticated OAuth state CSRF (login CSRF / account fixation). The core issue lies in how the application handles OAuth state parameters after a successful callback. Instead of completely removing the oauth_state_<integration> key from the session, the vulnerable code (session.Values[stateKey] = "") would set its value to an empty string. This created a scenario where a subsequent OAuth callback with an empty ?state= parameter would be considered valid by the ValidateOAuthState function, as the comparison logic (c.Request().URL.Query().Get("state") != session.Values[stateKey]) would see two empty strings and deem them a match. This allowed an attacker to fixate a victim's session to an attacker-controlled OAuth identity. The patch addresses this by explicitly checking for an empty state parameter in the request, using subtle.ConstantTimeCompare for secure string comparison, and crucially, by using delete(session.Values, stateKey) to remove the state key entirely from the session, preventing the empty-string collision.
authn.SessionHelpers.ValidateOAuthStateapi/v1/server/authn/session_helpers.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| hatchet | go | < 0.91.1 | 0.91.1 |