CVE-2026-33175

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

PYSEC-2026-2238

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +2 more potentially affected by CVE-2026-33175 via oauthenticator (0.13.0)

oauthenticator PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - jupyterhubutils =0.11.0, =0.9.1, =0.30.1, =0.0.2, =0.4.2 Source cves: CVE-2026-33175 Source advisory: OSV:PYSEC-2026-2238...

ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2026-33175 via oauthenticator (14.0.0)

oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2026-33175 Source advisory: OSV:PYSEC-2026-2238...

keycloakauthenticator (>=3.1.1, <=3.3.0) potentially affected by CVE-2026-33175 via oauthenticator (15.0.0)

oauthenticator PYPI version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.1.1, =3.3.0 Source cves: CVE-2026-33175 Source advisory: OSV:PYSEC-2026-2238...

keycloakauthenticator (>=4.0.0, <=4.0.4) potentially affected by CVE-2026-33175 via oauthenticator (16.1.0)

oauthenticator PYPI version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =4.0.0, =4.0.4 Source cves: CVE-2026-33175 Source advisory: OSV:PYSEC-2026-2238...

fabricauthenticator (>=0.0.2.5, <=0.0.2.7), jupyterhub-ltiauthenticator (1.3.0) potentially affected by CVE-2026-33175 via oauthenticator (16.2.1)

oauthenticator PYPI version 16.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =0.0.2.5, =0.0.2.7 - jupyterhub-ltiauthenticator 1.3.0 Source cves: CVE-2026-33175 Source advisory:...

keycloakauthenticator (>=3.0.0, <=3.1.0) potentially affected by CVE-2026-33175 via oauthenticator (14.2.0)

oauthenticator PYPI version 14.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.0.0, =3.1.0 Source cves: CVE-2026-33175 Source advisory: OSV:PYSEC-2026-2238...

keycloakauthenticator (>=4.0.5, <=4.0.13) potentially affected by CVE-2026-33175 via oauthenticator (16.3.1)

oauthenticator PYPI version 16.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =4.0.5, =4.0.13 Source cves: CVE-2026-33175 Source advisory: OSV:PYSEC-2026-2238...

fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.7) +4 more potentially affected by CVE-2026-33175 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2026-33175 Source advisory: OSV:PYSEC-2026-2...

CVE-2026-33175

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

CVE-2026-33175

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

fabricauthenticator (>=0.0.2.5, <=1.3.4), jupyterhub-ltiauthenticator (1.3.0) +11 more potentially affected by CVE-2026-33175 via oauthenticator (>=0.13.0, <=16.3.1)

oauthenticator PYPI version =0.13.0, =0.0.2.5, =0.11.0, =0.9.1, =3.0.0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.30.1, =0.2.25, =0.0.2, =0.4.2 Source cves: CVE-2026-33175 Source advisory: MEND:CVE-2026-33175...

CVE-2026-33175 OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

GHSA-RRVG-CXH4-QHRV Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

Summary An authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrnameclaim, this gives users control over their username and the possibility of account takeover. Impact This...

Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

Summary An authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrnameclaim, this gives users control over their username and the possibility of account takeover. Impact This...

jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +2 more potentially affected by CVE-2026-33175 via oauthenticator (0.13.0)

oauthenticator PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - jupyterhubutils =0.11.0, =0.9.1, =0.30.1, =0.0.2, =0.4.2 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...

keycloakauthenticator (>=3.0.0, <=3.1.0) potentially affected by CVE-2026-33175 via oauthenticator (14.2.0)

oauthenticator PYPI version 14.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.0.0, =3.1.0 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...

keycloakauthenticator (>=3.1.1, <=3.3.0) potentially affected by CVE-2026-33175 via oauthenticator (15.0.0)

oauthenticator PYPI version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.1.1, =3.3.0 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...

keycloakauthenticator (>=4.0.5, <=4.0.13) potentially affected by CVE-2026-33175 via oauthenticator (16.3.1)

oauthenticator PYPI version 16.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =4.0.5, =4.0.13 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...