keycloakauthenticator (>=4.0.5, <=4.0.13) potentially affected by CVE-2026-33175 via oauthenticator (16.3.1)

oauthenticator PYPI version 16.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =4.0.5, =4.0.13 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...

ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2026-33175 via oauthenticator (14.0.0)

oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...

keycloakauthenticator (>=4.0.0, <=4.0.4) potentially affected by CVE-2026-33175 via oauthenticator (16.1.0)

oauthenticator PYPI version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =4.0.0, =4.0.4 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...

fabricauthenticator (>=0.0.2.5, <=0.0.2.7), jupyterhub-ltiauthenticator (1.3.0) potentially affected by CVE-2026-33175 via oauthenticator (16.2.1)

oauthenticator PYPI version 16.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =0.0.2.5, =0.0.2.7 - jupyterhub-ltiauthenticator 1.3.0 Source cves: CVE-2026-33175 Source advisory:...

OAuthenticator security vulnerability

OAuthenticator is the OAuth token library used by the JupyerHub login process. Versions of OAuthenticator prior to 17.4.0 contained a security vulnerability. This vulnerability stemmed from an authentication bypass mechanism, which could allow attackers with unverified email addresses to log in t...

CVE-2026-33175: Improper Authentication

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

PT-2026-30250

Name of the Vulnerable Software and Affected Versions OAuthenticator versions prior to 17.4.0 Description OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. An authentication bypass issue exists that allows an attacker with an unverified...

CVE-2022-31027

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...

EUVD-2020-0118

Malware in sbrugna...

EUVD-2018-0080

Malware in sbrugna...

EUVD-2024-0822

Malicious code in bioql PyPI...

EUVD-2024-2058

Malicious code in bioql PyPI...

CVE-2024-29033

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized access to a JupyterHub. The...

Access Control Bypass

oauthenticator is vulnerable to Access Control Bypass. The vulnerability is due to the allowall setting taking precedence over identityprovider, allowing attackers to log in without restriction based on the intended institutional identity provider configuration...

ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2024-37300 via oauthenticator (14.0.0)

oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...

GHSA-GPRJ-3P75-F996 Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Impact JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like: python Require users to be using the "foo.horse" identity provider, often an institution or university...

GHSA-GPRJ-3P75-F996 vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

GHSA-GPRJ-3P75-F996 vulnerabilities

Vulnerabilities for packages: py3-oauthenticator...

jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +2 more potentially affected by CVE-2024-37300 via oauthenticator (0.13.0)

oauthenticator PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - jupyterhubutils =0.11.0, =0.9.1, =0.30.1, =0.0.2, =0.4.2 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...

fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.7) +4 more potentially affected by CVE-2024-37300 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2024-37300 Source advisory:...