fabricauthenticator (>=0.0.2.5, <=0.0.2.7), jupyterhub-ltiauthenticator (1.3.0) +1 more potentially affected by CVE-2024-37300 via oauthenticator (>=16.1.0, <=16.2.1)

oauthenticator PYPI version =16.1.0, =0.0.2.5, =4.0.0, =4.0.4 Source cves: CVE-2024-37300 Source advisory: OSV:PYSEC-2026-1711...

ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2024-37300 via oauthenticator (14.0.0)

oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2024-37300 Source advisory: OSV:PYSEC-2026-1711...

keycloakauthenticator (>=3.0.0, <=3.1.0) potentially affected by CVE-2024-37300 via oauthenticator (14.2.0)

oauthenticator PYPI version 14.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.0.0, =3.1.0 Source cves: CVE-2024-37300 Source advisory: OSV:PYSEC-2026-1711...

jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +2 more potentially affected by CVE-2024-37300 via oauthenticator (0.13.0)

oauthenticator PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - jupyterhubutils =0.11.0, =0.9.1, =0.30.1, =0.0.2, =0.4.2 Source cves: CVE-2024-37300 Source advisory: OSV:PYSEC-2026-1711...

keycloakauthenticator (>=3.1.1, <=3.3.0) potentially affected by CVE-2024-37300 via oauthenticator (15.0.0)

oauthenticator PYPI version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.1.1, =3.3.0 Source cves: CVE-2024-37300 Source advisory: OSV:PYSEC-2026-1711...

fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.6) +4 more potentially affected by CVE-2024-37300 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2024-37300 Source advisory: OSV:PYSEC-2026-1...

fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.6) +4 more potentially affected by CVE-2024-29033 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2024-29033 Source advisory: OSV:PYSEC-2026-1...

ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2024-29033 via oauthenticator (14.0.0)

oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2024-29033 Source advisory: OSV:PYSEC-2026-1710...

jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +2 more potentially affected by CVE-2024-29033 via oauthenticator (0.13.0)

oauthenticator PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - jupyterhubutils =0.11.0, =0.9.1, =0.30.1, =0.0.2, =0.4.2 Source cves: CVE-2024-29033 Source advisory: OSV:PYSEC-2026-1710...

keycloakauthenticator (>=3.0.0, <=3.1.0) potentially affected by CVE-2024-29033 via oauthenticator (14.2.0)

oauthenticator PYPI version 14.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.0.0, =3.1.0 Source cves: CVE-2024-29033 Source advisory: OSV:PYSEC-2026-1710...

GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

Summary and impactGoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized to access a JupyterHub. The restriction is intended to ensure Google accounts are part of one or more Google organizations/workspaces verified to control specified domains.The...

PYSEC-2026-1710 GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

Summary and impact GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized to access a JupyterHub. The restriction is intended to ensure Google accounts are part of one or more Google organizations/workspaces verified to control specified domains. The...

fabricauthenticator (>=0.0.2.5, <=0.0.2.7), jupyterhub-ltiauthenticator (1.3.0) +1 more potentially affected by CVE-2024-29033 via oauthenticator (>=16.1.0, <=16.2.1)

oauthenticator PYPI version =16.1.0, =0.0.2.5, =4.0.0, =4.0.4 Source cves: CVE-2024-29033 Source advisory: OSV:PYSEC-2026-1710...

keycloakauthenticator (>=3.1.1, <=3.3.0) potentially affected by CVE-2024-29033 via oauthenticator (15.0.0)

oauthenticator PYPI version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.1.1, =3.3.0 Source cves: CVE-2024-29033 Source advisory: OSV:PYSEC-2026-1710...

GHSA-RRVG-CXH4-QHRV vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

CVE-2026-33175 vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

CVE-2026-33175 vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

GHSA-RRVG-CXH4-QHRV vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

CVE-2026-33175

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the authentication when usernameclaim is set to email and email verification is not enforced. An attacker can gain unauthorized access and potentially take over accounts by using an unverified email address o...