fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.6) +4 more potentially affected by CVE-2026-33175 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2026-33175 Source advisory:...

ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2026-33175 via oauthenticator (14.0.0)

oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2026-33175 Source advisory: OSV:GHSA-RRVG-CXH4-QHRV...

GHSA-RRVG-CXH4-QHRV Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

Summary An authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrnameclaim, this gives users control over their username and the possibility of account takeover. Impact This...

Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

Summary An authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrnameclaim, this gives users control over their username and the possibility of account takeover. Impact This...

PT-2026-30250

Name of the Vulnerable Software and Affected Versions OAuthenticator versions prior to 17.4.0 Description OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. An authentication bypass issue exists that allows an attacker with an unverified...

OAuthenticator security vulnerability

OAuthenticator is the OAuth token library used by the JupyerHub login process. Versions of OAuthenticator prior to 17.4.0 contained a security vulnerability. This vulnerability stemmed from an authentication bypass mechanism, which could allow attackers with unverified email addresses to log in t...

CVE-2026-33175: Improper Authentication

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email i...

CVE-2022-31027

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowedidps...

EUVD-2020-0118

Malware in sbrugna...

EUVD-2018-0080

Malware in sbrugna...

EUVD-2024-2058

Malicious code in bioql PyPI...

EUVD-2024-0822

Malicious code in bioql PyPI...

CVE-2024-29033

OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. GoogleOAuthenticator.hosteddomain is used to restrict what Google accounts can be authorized access to a JupyterHub. The...

Access Control Bypass

oauthenticator is vulnerable to Access Control Bypass. The vulnerability is due to the allowall setting taking precedence over identityprovider, allowing attackers to log in without restriction based on the intended institutional identity provider configuration...

keycloakauthenticator (>=3.1.1, <=3.3.0) potentially affected by CVE-2024-37300 via oauthenticator (15.0.0)

oauthenticator PYPI version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.1.1, =3.3.0 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...

ssb-ipython-kernels (>=0.2.25, <=0.3.2) potentially affected by CVE-2024-37300 via oauthenticator (14.0.0)

oauthenticator PYPI version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - ssb-ipython-kernels =0.2.25, =0.3.2 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...

fabricauthenticator (>=0.0.2.5, <=0.0.2.7), jupyterhub-ltiauthenticator (1.3.0) +1 more potentially affected by CVE-2024-37300 via oauthenticator (>=16.1.0, <=16.2.1)

oauthenticator PYPI version =16.1.0, =0.0.2.5, =4.0.0, =4.0.4 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...

fabricauthenticator (>=1.3.1b0, <=1.3.4), nomad-catalysis (>=1.0.2, <=1.0.6) +4 more potentially affected by CVE-2024-37300 via oauthenticator (15.1.0)

oauthenticator PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - fabricauthenticator =1.3.1b0, =1.0.2, =0.1.0, =1.1.9, =0.5.0, =0.10.0 Source cves: CVE-2024-37300 Source advisory:...

keycloakauthenticator (>=3.0.0, <=3.1.0) potentially affected by CVE-2024-37300 via oauthenticator (14.2.0)

oauthenticator PYPI version 14.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - keycloakauthenticator =3.0.0, =3.1.0 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...

jupyterhubutils (>=0.11.0, <=0.25.0), jupyterlabutils (>=0.9.1, <=0.10.0) +2 more potentially affected by CVE-2024-37300 via oauthenticator (0.13.0)

oauthenticator PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on oauthenticator and may be impacted: - jupyterhubutils =0.11.0, =0.9.1, =0.30.1, =0.0.2, =0.4.2 Source cves: CVE-2024-37300 Source advisory: OSV:GHSA-GPRJ-3P75-F996...