CVE-2020-26250

CVE-2020-26250 affects OAuthenticator (used by JupyterHub). In versions 0.12.0–0.12.1, the deprecated Authenticator.whitelist is ignored, effectively allowing any authenticated user if no group restrictions exist. Provider-based restrictions are unaffected. A log line such as Not using allowed_us...