CVE-2026-33175
Authentication Bypass in OAuthenticator Enables JupyterHub Account Takeover
Publication date: 2026-04-03
Last updated on: 2026-04-15
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| jupyter | oauthenticator | to 17.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in OAuthenticator, a software component that integrates OAuth2 identity providers with JupyterHub. Before version 17.4.0, there was an authentication bypass issue in oauthenticator that allowed an attacker with an unverified email address on an Auth0 tenant to log in to JupyterHub.
When the email is used as the username_claim, this flaw enables attackers to control their username and potentially take over accounts.
This vulnerability was fixed in version 17.4.0 of oauthenticator.
How can this vulnerability impact me? :
This vulnerability can allow attackers to bypass authentication and gain unauthorized access to JupyterHub accounts.
Because attackers can control the username when email is used as the username_claim, they may take over user accounts, leading to potential data breaches or unauthorized actions within the system.
The CVSS score of 8.8 indicates a high severity impact, including high confidentiality, integrity, and availability impacts.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade oauthenticator to version 17.4.0 or later, where the authentication bypass issue has been patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an attacker with an unverified email address to bypass authentication and potentially take over user accounts by controlling usernames. This could lead to unauthorized access to sensitive data.
Such unauthorized access may result in violations of common standards and regulations like GDPR and HIPAA, which require strict controls on user authentication and protection of personal and health information.
Therefore, this vulnerability could negatively impact compliance by exposing systems to account takeover and data breaches.