PT-2026-30250 · Unknown+1 · Jupyterhub+2
Jaynornj
+1
·
Published
2026-04-03
·
Updated
2026-05-18
·
CVE-2026-33175
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OAuthenticator versions prior to 17.4.0
Description
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. An authentication bypass issue exists that allows an attacker with an unverified email address on an Auth0 tenant to log in to JupyterHub. When
email is used as the username claim, this gives users control over their username and the possibility of account takeover. This impacts any Auth0 tenant leveraging the Auth0OAuthenticator mapping the email claim to the JupyterHub username.Recommendations
Upgrade OAuthenticator to version 17.4.0.
As a workaround, check the
email verified field in an Authenticator.post auth hook function.
As a workaround, do not use email as the username claim.
As a workaround, enforce email verification in Auth0.Fix
Improper Authentication
Authentication Bypass by Spoofing
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Auth0Oauthenticator
Jupyterhub
Authenticator