Authentication Bypass

2024-03-2207:04:09

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

oauthenticator

authentication bypass

google accounts

vulnerability

validation

specified domain

6.6 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.6%

JSON

oauthenticator is vulnerable to Authentication Bypass. The vulnerability exists due to insufficient validation of Google accounts, which allowed access to accounts created by anyone with emails ending with a specified domain.

CPENameOperatorVersion
oauthenticatorle16.2.1
oauthenticatorle16.2.1

CPE	Name	Operator	Version
	oauthenticator	le	16.2.1
	oauthenticator	le	16.2.1

References

github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60

github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h

trufflesecurity.com/blog/google-oauth-is-broken-sort-of