TI-2026-25605 Aliases CVE-2026-33175 GHSA-rrvg-cxh4-qhrv

OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

MEDIUM 40CWE-287Published 2026-04-03 · Updated 2026-04-07

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287.

Summary

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00446 38th percentileScored 2026-11-07

Fix Fixed oauthenticator (jupyterhub): 17.4.0oauthenticator (PyPI): 17.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
jupyterhub	oauthenticator	before 17.4.0	17.4.0	Patch available	CNA
—	oauthenticator (PyPI)	before 17.4.0	17.4.0	Patch available	GHSA-rrvg-cxh4-qhrv

oauthenticator Vendorjupyterhub Affected before 17.4.0 Fixed in 17.4.0 Patch available CNA
oauthenticator (PyPI) Vendor— Affected before 17.4.0 Fixed in 17.4.0 Patch available GHSA-rrvg-cxh4-qhrv

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:jupyter:oauthenticator::::::::	before 17.4.0	Vulnerable	jupyterlab

cpe:2.3:a:jupyter:oauthenticator:*:*:*:*:*:*:*:* Versions before 17.4.0 Vulnerable ·jupyterlab

Remediation

Fix · CNA oauthenticator (jupyterhub) Fixed in 17.4.0
Fix · GHSA-rrvg-cxh4-qhrv oauthenticator (PyPI) Fixed in 17.4.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33175
2026-10-03 Alias added: GHSA-rrvg-cxh4-qhrv
2026-10-23 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 1

https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9

Advisory 2

Other 3

TI-2025-23499 Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended CVSS 4.0CRITICAL 9.0
TI-2023-10877 JupyterHub's LTI13Authenticator: JWT signature not validated CVSS 3.1CRITICAL 10.0
TI-2021-16545 Remote code execution in Binderhub CVSS 3.1CRITICAL 9.8
TI-2021-18033 Improper Access Control in jupyterhub-firstuseauthenticator CVSS 3.1CRITICAL 9.8
TI-2021-16546 Code injection in nbgitpuller CVSS 3.1CRITICAL 9.6
TI-2024-18755 Jupyter Server Proxy's Websocket Proxying does not require authentication CVSS 3.1CRITICAL 9.8

See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences