BIT-JUPYTERHUB-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

CVE-2026-108752

JupyterHub versions through 6.0.1 are vulnerable to an identifier collision vulnerability caused by the use of unescaped hyphens in usernames. This flaw allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username (e.g., a user with the nam...

CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...

CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking...