CVE-2026-33175
Received Received - Intake
Authentication Bypass in OAuthenticator Enables JupyterHub Account Takeover

Publication date: 2026-04-03

Last updated on: 2026-04-15

Assigner: GitHub, Inc.

Description
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-03
Last Modified
2026-04-15
Generated
2026-06-16
AI Q&A
2026-04-04
EPSS Evaluated
2026-06-14
NVD
CVE-2026-33175
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
jupyter oauthenticator to 17.4.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows an attacker with an unverified email address to bypass authentication and potentially take over user accounts by controlling usernames. This could lead to unauthorized access to sensitive data.

Such unauthorized access may result in violations of common standards and regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal and health information.

Therefore, this vulnerability could negatively impact compliance by exposing systems to account takeover and data breaches.

Executive Summary

The vulnerability exists in OAuthenticator, a software component that integrates OAuth2 identity providers with JupyterHub. Before version 17.4.0, there was an authentication bypass issue in oauthenticator that allowed an attacker with an unverified email address on an Auth0 tenant to log in to JupyterHub.

When the email is used as the username_claim, this flaw enables attackers to control their username and potentially take over accounts.

This vulnerability was fixed in version 17.4.0 of oauthenticator.

Impact Analysis

This vulnerability can allow attackers to bypass authentication and gain unauthorized access to JupyterHub accounts.

Because attackers can control the username when email is used as the username_claim, they may take over user accounts, leading to potential data breaches or unauthorized actions within the system.

The CVSS score of 8.8 indicates a high severity impact, including high confidentiality, integrity, and availability impacts.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade oauthenticator to version 17.4.0 or later, where the authentication bypass issue has been patched.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-33175. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart