CVE-2026-61687: Hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Hatchet version v0.86.26 and below is vulnerable to OAuth state CSRF (login CSRF / account fixation).

The vulnerable code clears the session oauth_state_<integration> value to the empty string "" after a successful OAuth callback rather than removing the key, and the subsequent state-equality check then accepts an empty ?state= parameter on any later callback request — allowing an unauthenticated attacker to bind an already-authenticated victim’s session cookie to an attacker-controlled OAuth identity (account takeover via login-CSRF).