TI-2024-19215 Aliases CVE-2024-29033 GHSA-55m3-44xf-hg4h

GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

MEDIUM 40CWE-285Published 2024-03-20 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-285.

Summary

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authorized access to a JupyterHub. The restriction is intented to be to Google accounts part of one or more Google organization verified to control specified domain(s). Prior to version 16.3.0, the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this [blog post] from 15th December 2023). OAuthenticator 16.3.0 contains a patch for this issue. As a workaround, restrict who can login another way, such as `allowed_users` or `allowed_google_groups`.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00589 48th percentileScored 2026-11-07

Fix Fixed oauthenticator (jupyterhub): 16.3.0oauthenticator (PyPI): 16.3.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jupyterhub	oauthenticator	before 16.3.0	16.3.0	Patch available	CNA
—	oauthenticator (PyPI)	before 16.3.0	16.3.0	Patch available	GHSA-55m3-44xf-hg4h

oauthenticator Vendorjupyterhub Affected before 16.3.0 Fixed in 16.3.0 Patch available CNA
oauthenticator (PyPI) Vendor— Affected before 16.3.0 Fixed in 16.3.0 Patch available GHSA-55m3-44xf-hg4h

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jupyter:oauthenticator::::::::	before 16.3.0	Vulnerable	jupyterlab

cpe:2.3:a:jupyter:oauthenticator:*:*:*:*:*:*:*:* Versions before 16.3.0 Vulnerable ·jupyterlab

Remediation

Fix · CNA oauthenticator (jupyterhub) Fixed in 16.3.0
Fix · GHSA-55m3-44xf-hg4h oauthenticator (PyPI) Fixed in 16.3.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2024-29033
2026-10-03 Alias added: GHSA-55m3-44xf-hg4h

References

Patch 1

https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60

Advisory 3

Other 1

https://github.com/jupyterhub/oauthenticator

TI-2025-23499 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended CVSS 4.0CRITICAL 9.0
TI-2023-10877 JupyterHub's LTI13Authenticator: JWT signature not validated CVSS 3.1CRITICAL 10.0
TI-2021-16545 Remote code execution in Binderhub CVSS 3.1CRITICAL 9.8
TI-2021-18033 Improper Access Control in jupyterhub-firstuseauthenticator CVSS 3.1CRITICAL 9.8
TI-2021-16546 Code injection in nbgitpuller CVSS 3.1CRITICAL 9.6
TI-2024-18755 Jupyter Server Proxy's Websocket Proxying does not require authentication CVSS 3.1CRITICAL 9.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences