← Back

CVE-2026-33175

nvd nist
Published: Apr 3, 2026Modified: Jul 24, 2026

JSON object

Loading...
8.8
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 2.8 / Impact: 5.9
Source: security-advisories@github.com (Secondary)

Description

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.

Affected (1)

Jupyter
1 product
Oauthenticator
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Oauthenticator
Before 17.4.0

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-290
Authentication Bypass by Spoofing
This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

References (3)

Source: security-advisories@github.com
Patch
Source: security-advisories@github.com
Product
Source: security-advisories@github.com
MitigationVendor Advisory

Timeline

No history available yet.