Vulnerabilities

TI-2026-25605 CVE-2026-33175 · GHSA-rrvg-cxh4-qhrv

OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

MEDIUM 40

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00446 Published 2026-04-03 Fixed in 17.4.0 CWE-287

TI-2024-19215 CVE-2024-29033 · GHSA-55m3-44xf-hg4h

GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

MEDIUM 40

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00589 Published 2024-03-20 Fixed in 16.3.0 CWE-285

TI-2022-13072 CVE-2022-31027 · GHSA-r7v4-jwx9-wx43

Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator

LOW 29

OAuthenticator is an OAuth token library for the JupyerHub login handler.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00475 Published 2022-06-06 Fixed in 15.0.0 CWE-639

TI-2020-16071 CVE-2020-26250 · GHSA-384w-5v3f-q499

Base class whitelist configuration ignored in OAuthenticator

LOW 30

OAuthenticator is an OAuth login mechanism for JupyterHub.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.01132 Published 2020-12-01 Fixed in 0.12.2 CWE-863

TI-2018-05223 CVE-2018-7206 · GHSA-8x3m-m3x9-54fj

An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2…

MEDIUM 42

An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01774 Published 2018-02-18 Fixed in 0.6.2, 0.7.3