CVE-2020-26250: Incorrect Authorization

OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated in jupyterhub 1.2 configuration Authenticator.whitelist, which should be transparently mapped to Authenticator.allowedusers with a warning, is instead ignored by...

PT-2020-16377

Name of the Vulnerable Software and Affected Versions oauthenticator versions 0.12.0 through 0.12.1 Description The deprecated configuration Authenticator.whitelist is ignored by OAuthenticator classes, resulting in all authenticated users being allowed if no group or team restrictions are in...