PYSEC-2026-2238

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

PT-2024-27458

Name of the Vulnerable Software and Affected Versions JupyterHub versions prior to 5.0 OAuthenticator version prior to 16.3.1 Description The issue arises from a change in JupyterHub 5.0 where the allow all parameter takes precedence over the identity provider parameter when using...