Hatchet v0.86.26 and Below Vulnerable to OAuth State CSRF

According to the GitHub Security Advisory database, Hatchet versions v0.86.26 and earlier are affected by a high-severity vulnerability involving OAuth state CSRF. The issue arises from the way the `ValidateOAuthState` function handles the session `oauth_state_` value after an OAuth callback. Instead of removing the session key entirely, the code clears its value to an empty string. This behavior allows an unauthenticated attacker to exploit the subsequent state-equality check, accepting an empty `?state=` parameter on later callback requests. The result is a potential account takeover via login-CSRF, where the victim's session cookie can be bound to an attacker-controlled OAuth identity.

Operators should carefully assess whether their deployment enables any of the affected integrations, such as Google, GitHub, or Slack OAuth, and whether users frequently complete OAuth flows in active sessions. If these conditions are met, the vulnerability could expose users to account fixation attacks. Before upgrading, ensure that any customizations or configurations tied to OAuth flows are compatible with the patched version, as changes to session handling may impact workflows. This advisory highlights the importance of rigorous state validation in OAuth implementations, a recurring theme in security updates across projects.