PT-2024-22686 · Unknown · Authenticator

Manics · Published 2024-03-20 · Updated 2025-12-03 · CVE-2024-29033

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions oauthenticator versions prior to 16.3.0

Description The issue is related to the GoogleOAuthenticator.hosted domain parameter, which is intended to restrict access to Google accounts that are part of one or more Google organizations verified to control specified domain(s). However, prior to version 16.3.0, the actual restriction was to Google accounts with emails ending with the domain, allowing accounts created by anyone who could read an email associated with the domain to access the system. This was described by Dylan Ayrey in a blog post from 15th December 2023. OAuthenticator 16.3.0 contains a patch for this issue.

Recommendations For versions prior to 16.3.0, upgrade to oauthenticator version 16.3.0 or later. As a temporary workaround, restrict who can login another way, such as using allowed users or allowed google groups.

Exploit

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2024-29033

GHSA-55M3-44XF-HG4H

Affected Products

Authenticator

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29033.json · Exploit
• https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h · Vendor Advisory
• https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-29033 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29033 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-55m3-44xf-hg4h · Vendor Advisory
• https://github.com/jupyterhub/oauthenticator · Note
• https://t.me/cveNotify/144651 · Telegram Post
• https://t.me/cvenotify/74301 · Telegram Post
• https://twitter.com/RedPacketSec/status/1772202415237849217 · Twitter Post
• https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of · Note
• https://twitter.com/cracbot/status/1770899645960519872 · Twitter Post
• https://twitter.com/oktsec/status/1771447232182542757 · Twitter Post