CVE-2022-31027

CVE-2022-31027 affects the OAuthenticator/CILogonOAuthenticator used by JupyterHub. The root cause is that allowed_idps is validated only by email domain, not by IdP (provider) identity, allowing login via an alternate IdP with a @domained email (e.g., berkeley.edu) to bypass intended restriction...

CVE-2024-29033

CVE-2024-29033 concerns GoogleOAuthenticator.hosted_domain in OAuthenticator for JupyterHub. The root issue is that prior to version 16.3.0 the restriction was applied to Google accounts by email domain rather than guaranteed membership in a Google organization/workspace, allowing accounts create...

CVE-2020-26250

CVE-2020-26250 affects OAuthenticator (used by JupyterHub). In versions 0.12.0–0.12.1, the deprecated Authenticator.whitelist is ignored, effectively allowing any authenticated user if no group restrictions exist. Provider-based restrictions are unaffected. A log line such as Not using allowed_us...

CVE-2018-7206

The CVE relates to JupyterHub OAuthenticator in Project Jupyter JupyterHub, where GitLab group whitelisting was not enforced correctly. Affected versions are OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. The flaw could let whitelisted-group members fail to be required for account crea...

CVE-2026-33175

CVE-2026-33175 affects OAuthenticator for JupyterHub. Before 17.4.0, an authentication bypass via unverified emails on an Auth0 tenant when email is used as the usrname_claim can allow login and potential account takeover. Affected: OAuthenticator versions before 17.4.0 integrated with JupyterHub...