oauthenticator vulnerabilities

3 known vulnerabilities in oauthenticator from Jupyterhub. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  oauthenticator: Improper Authentication

  CVE-2026-33175Apr 3, 2026Jupyterhub

  OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant

• 8.1 High severity

  oauthenticator: Incorrect Authorization

  CVE-2024-37300Jun 12, 2024Jupyterhub

  OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine pri

• 9.1 Critical severity

  oauthenticator: Improper Authorization

  CVE-2024-29033Mar 20, 2024Jupyterhub

  OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing one's own Authenticators with any OAuth 2.0 provider. `GoogleOAuthenticator.hosted_domain` is used to restrict what Google accounts can be authori