Vulnerability-Lookup

CVE-2026-33175 (GCVE-0-2026-33175)

Vulnerability from cvelistv5 – Published: 2026-04-03 21:56 – Updated: 2026-04-07 16:01

Title

OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

Summary

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-287 - Improper Authentication
CWE-290 - Authentication Bypass by Spoofing

Assigner

GitHub_M

References

3 references

URL	Tags
https://github.com/jupyterhub/oauthenticator/secu…	x_refsource_CONFIRM
https://github.com/jupyterhub/oauthenticator/comm…	x_refsource_MISC
https://github.com/jupyterhub/oauthenticator/rele…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
jupyterhub	oauthenticator	Affected: < 17.4.0

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-33175",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-04-07T15:48:30.664149Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-04-07T16:01:12.600Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oauthenticator",
          "vendor": "jupyterhub",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 17.4.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-287",
              "description": "CWE-287: Improper Authentication",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-290",
              "description": "CWE-290: Authentication Bypass by Spoofing",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-03T21:56:26.830Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv"
        },
        {
          "name": "https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9"
        },
        {
          "name": "https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0"
        }
      ],
      "source": {
        "advisory": "GHSA-rrvg-cxh4-qhrv",
        "discovery": "UNKNOWN"
      },
      "title": "OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-33175",
    "datePublished": "2026-04-03T21:56:26.830Z",
    "dateReserved": "2026-03-17T22:16:36.719Z",
    "dateUpdated": "2026-04-07T16:01:12.600Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-33175",
      "date": "2026-07-27",
      "epss": "0.00438",
      "percentile": "0.35862"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-33175\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-04-03T22:16:26.483\",\"lastModified\":\"2026-07-24T22:10:00.140\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.\"},{\"lang\":\"es\",\"value\":\"OAuthenticator es un software que permite que los proveedores de identidad OAuth2 se conecten y se utilicen con JupyterHub. Antes de la versi\u00f3n 17.4.0, una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en oauthenticator permite a un atacante con una direcci\u00f3n de correo electr\u00f3nico no verificada en un inquilino de Auth0 iniciar sesi\u00f3n en JupyterHub. Cuando el correo electr\u00f3nico se utiliza como el usrname_claim, esto da a los usuarios control sobre su nombre de usuario y la posibilidad de toma de control de cuenta. Este problema ha sido parcheado en la versi\u00f3n 17.4.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jupyterhub\",\"product\":\"oauthenticator\",\"versions\":[{\"version\":\"\u003c 17.4.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-07T15:48:30.664149Z\",\"id\":\"CVE-2026-33175\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-287\"},{\"lang\":\"en\",\"value\":\"CWE-290\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jupyter:oauthenticator:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"17.4.0\",\"matchCriteriaId\":\"AD3BB317-293C-4D0B-8065-76735EA8AF80\"}]}]}],\"references\":[{\"url\":\"https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Product\"]},{\"url\":\"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "current_release_date": "2026-04-06T10:57:10+00:00",
      "cve": "CVE-2026-33175",
      "id": "CVE-2026-33175",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33175.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-33175\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-04-07T15:48:30.664149Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-04-07T15:48:34.428Z\"}}], \"cna\": {\"title\": \"OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims\", \"source\": {\"advisory\": \"GHSA-rrvg-cxh4-qhrv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"jupyterhub\", \"product\": \"oauthenticator\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c 17.4.0\"}]}], \"references\": [{\"url\": \"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv\", \"name\": \"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9\", \"name\": \"https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0\", \"name\": \"https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-287\", \"description\": \"CWE-287: Improper Authentication\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-290\", \"description\": \"CWE-290: Authentication Bypass by Spoofing\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-04-03T21:56:26.830Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-33175\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-07T16:01:12.600Z\", \"dateReserved\": \"2026-03-17T22:16:36.719Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-04-03T21:56:26.830Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

cleanstart-2026-an27706

Vulnerability from cleanstart

Published

2026-05-18 13:26

Modified

2026-05-12 12:08

Summary

Security fixes for CVE-2026-22815, CVE-2026-30922, CVE-2026-31958, CVE-2026-32597, CVE-2026-33175, CVE-2026-34052, CVE-2026-34073, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-44431, CVE-2026-44432, ghsa-752w-5fwx-jx9f, ghsa-78cv-mqj4-43f7, ghsa-gc5v-m9x4-r6x2, ghsa-jr27-m4p2-rc6r, ghsa-m959-cc7f-wv43, ghsa-qjxf-f2mg-c6mc applied in versions: 4.3.2-r0, 4.3.2-r1, 4.3.2-r2, 4.3.2-r3

Details

Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details.

References

URL

Type

	https://github.com/cleanstart-dev/cleanstart-secu…	ADVISORY
	https://osv.dev/vulnerability/CVE-2026-22815	WEB
	https://osv.dev/vulnerability/CVE-2026-30922	WEB
	https://osv.dev/vulnerability/CVE-2026-31958	WEB
	https://osv.dev/vulnerability/CVE-2026-32597	WEB
	https://osv.dev/vulnerability/CVE-2026-33175	WEB
	https://osv.dev/vulnerability/CVE-2026-34052	WEB
	https://osv.dev/vulnerability/CVE-2026-34073	WEB
	https://osv.dev/vulnerability/CVE-2026-34513	WEB
	https://osv.dev/vulnerability/CVE-2026-34514	WEB
	https://osv.dev/vulnerability/CVE-2026-34515	WEB
	https://osv.dev/vulnerability/CVE-2026-34516	WEB
	https://osv.dev/vulnerability/CVE-2026-34517	WEB
	https://osv.dev/vulnerability/CVE-2026-34518	WEB
	https://osv.dev/vulnerability/CVE-2026-34519	WEB
	https://osv.dev/vulnerability/CVE-2026-34520	WEB
	https://osv.dev/vulnerability/CVE-2026-34525	WEB
	https://osv.dev/vulnerability/CVE-2026-44431	WEB
	https://osv.dev/vulnerability/CVE-2026-44432	WEB
	https://osv.dev/vulnerability/ghsa-752w-5fwx-jx9f	WEB
	https://osv.dev/vulnerability/ghsa-78cv-mqj4-43f7	WEB
	https://osv.dev/vulnerability/ghsa-gc5v-m9x4-r6x2	WEB
	https://osv.dev/vulnerability/ghsa-jr27-m4p2-rc6r	WEB
	https://osv.dev/vulnerability/ghsa-m959-cc7f-wv43	WEB
	https://osv.dev/vulnerability/ghsa-qjxf-f2mg-c6mc	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-22815	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-30922	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-31958	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-32597	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-33175	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34052	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34073	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34513	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34514	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34515	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34516	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34517	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34518	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34519	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34520	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-34525	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44431	WEB
	https://nvd.nist.gov/vuln/detail/CVE-2026-44432	WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "jupyterhub-k8s-hub"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.3.2-r3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Multiple security vulnerabilities affect the jupyterhub-k8s-hub package. These issues are resolved in later releases. See references for individual vulnerability details.",
  "id": "CLEANSTART-2026-AN27706",
  "modified": "2026-05-12T12:08:41Z",
  "published": "2026-05-18T13:26:17.643663Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AN27706.json"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-22815"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-30922"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-31958"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-32597"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-33175"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34052"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34073"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34513"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34514"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34515"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34516"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34517"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34518"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34519"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34520"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-34525"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44431"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/CVE-2026-44432"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-752w-5fwx-jx9f"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-78cv-mqj4-43f7"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-gc5v-m9x4-r6x2"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-jr27-m4p2-rc6r"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-m959-cc7f-wv43"
    },
    {
      "type": "WEB",
      "url": "https://osv.dev/vulnerability/ghsa-qjxf-f2mg-c6mc"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22815"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30922"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31958"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32597"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33175"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34052"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34073"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34513"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34514"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34515"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34516"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34517"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34518"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34519"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34520"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34525"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes for CVE-2026-22815, CVE-2026-30922, CVE-2026-31958, CVE-2026-32597, CVE-2026-33175, CVE-2026-34052, CVE-2026-34073, CVE-2026-34513, CVE-2026-34514, CVE-2026-34515, CVE-2026-34516, CVE-2026-34517, CVE-2026-34518, CVE-2026-34519, CVE-2026-34520, CVE-2026-34525, CVE-2026-44431, CVE-2026-44432, ghsa-752w-5fwx-jx9f, ghsa-78cv-mqj4-43f7, ghsa-gc5v-m9x4-r6x2, ghsa-jr27-m4p2-rc6r, ghsa-m959-cc7f-wv43, ghsa-qjxf-f2mg-c6mc applied in versions: 4.3.2-r0, 4.3.2-r1, 4.3.2-r2, 4.3.2-r3",
  "upstream": [
    "CVE-2026-22815",
    "CVE-2026-30922",
    "CVE-2026-31958",
    "CVE-2026-32597",
    "CVE-2026-33175",
    "CVE-2026-34052",
    "CVE-2026-34073",
    "CVE-2026-34513",
    "CVE-2026-34514",
    "CVE-2026-34515",
    "CVE-2026-34516",
    "CVE-2026-34517",
    "CVE-2026-34518",
    "CVE-2026-34519",
    "CVE-2026-34520",
    "CVE-2026-34525",
    "CVE-2026-44431",
    "CVE-2026-44432",
    "ghsa-752w-5fwx-jx9f",
    "ghsa-78cv-mqj4-43f7",
    "ghsa-gc5v-m9x4-r6x2",
    "ghsa-jr27-m4p2-rc6r",
    "ghsa-m959-cc7f-wv43",
    "ghsa-qjxf-f2mg-c6mc"
  ]
}

FKIE_CVE-2026-33175

Vulnerability from fkie_nvd - Published: 2026-04-03 22:16 - Updated: 2026-06-17 10:37

Severity

8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9	Patch
security-advisories@github.com	https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0	Product
security-advisories@github.com	https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv	Mitigation, Vendor Advisory

Impacted products

	Vendor	Product	Version
	jupyter	oauthenticator	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "oauthenticator",
          "vendor": "jupyterhub",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 17.4.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jupyter:oauthenticator:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD3BB317-293C-4D0B-8065-76735EA8AF80",
              "versionEndExcluding": "17.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0."
    }
  ],
  "id": "CVE-2026-33175",
  "lastModified": "2026-06-17T10:37:04.913",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-33175",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-04-07T15:48:30.664149Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-04-03T22:16:26.483",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product"
      ],
      "url": "https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        },
        {
          "lang": "en",
          "value": "CWE-290"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RRVG-CXH4-QHRV

Vulnerability from github – Published: 2026-04-03 21:35 – Updated: 2026-04-06 23:09

Summary

Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims

Details

Summary

An authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover.

Impact

This is an Authentication Bypass Vulnerability. Any Auth0 tenant leveraging the Auth0OAuthenticator mapping the email claim to the JupyterHub username is impacted. By default, Auth0 handles email verification as a user flag, not a hard block to authentication streams. If an attacker can register an account with the Auth0 tenant with an unverified email and knows the email of an existing user on the system, they can authenticate as that user.

Patches

Upgrade oauthenticator to 17.4

Workarounds

Check email_verified field in an Authenticator.post_auth_hook function
Do not use email as the username claim
Enforce email verification in auth0

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "oauthenticator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33175"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-287",
      "CWE-290"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-04-03T21:35:37Z",
    "nvd_published_at": "2026-04-03T22:16:26Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn authentication bypass vulnerability in `oauthenticator` allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When `email` is used as the usrname_claim, this gives users control over their username and the possibility of account takeover.\n\n### Impact\n\nThis is an **Authentication Bypass Vulnerability**. Any Auth0 tenant leveraging the `Auth0OAuthenticator` mapping the `email` claim to the JupyterHub username is impacted. By default, Auth0 handles email verification as a user flag, not a hard block to authentication streams. If an attacker can register an account with the Auth0 tenant with an unverified email and knows the email of an existing user on the system, they can authenticate as that user.\n\n### Patches\n\n- Upgrade oauthenticator to 17.4\n\n### Workarounds\n\n- Check `email_verified` field in an `Authenticator.post_auth_hook` function\n- Do not use `email` as the username claim\n- [Enforce email verification in auth0](https://support.auth0.com/center/s/article/Enforce-Email-Verification-With-Sending-Email-After-Each-Denied-Access)",
  "id": "GHSA-rrvg-cxh4-qhrv",
  "modified": "2026-04-06T23:09:50Z",
  "published": "2026-04-03T21:35:37Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33175"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyterhub/oauthenticator"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0"
    },
    {
      "type": "WEB",
      "url": "https://support.auth0.com/center/s/article/Enforce-Email-Verification-With-Sending-Email-After-Each-Denied-Access"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims"
}

PYSEC-2026-2238

Vulnerability from pysec - Published: 2026-04-03 22:16 - Updated: 2026-07-13 05:50

Details

Severity

8.8 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Impacted products

Name	purl
oauthenticator	pkg:pypi/oauthenticator

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {},
      "package": {
        "ecosystem": "PyPI",
        "name": "oauthenticator",
        "purl": "pkg:pypi/oauthenticator"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "17.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.1.0",
        "0.10.0",
        "0.11.0",
        "0.12.0",
        "0.12.1",
        "0.12.2",
        "0.12.3",
        "0.13.0",
        "0.2.0",
        "0.3.0",
        "0.4.0",
        "0.4.1",
        "0.5.0",
        "0.5.1",
        "0.6.0",
        "0.6.1",
        "0.6.2",
        "0.7.0",
        "0.7.1",
        "0.7.2",
        "0.7.3",
        "0.8.0",
        "0.8.1",
        "0.8.2",
        "0.9.0",
        "14.0.0",
        "14.1.0",
        "14.2.0",
        "15.0.0",
        "15.0.1",
        "15.1.0",
        "16.0.0",
        "16.0.1",
        "16.0.2",
        "16.0.3",
        "16.0.4",
        "16.0.5",
        "16.0.6",
        "16.0.7",
        "16.1.0",
        "16.1.1",
        "16.2.0",
        "16.2.1",
        "16.3.0",
        "16.3.1",
        "17.0.0",
        "17.1.0",
        "17.2.0",
        "17.3.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33175",
    "GHSA-rrvg-cxh4-qhrv"
  ],
  "details": "OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.",
  "id": "PYSEC-2026-2238",
  "modified": "2026-07-13T05:50:23.404977Z",
  "published": "2026-04-03T22:16:26.483Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv"
    },
    {
      "type": "FIX",
      "url": "https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-33175 (GCVE-0-2026-33175)

cleanstart-2026-an27706

Vulnerability from cleanstart

FKIE_CVE-2026-33175

GHSA-RRVG-CXH4-QHRV

Summary

Impact

Patches

Workarounds

PYSEC-2026-2238

Tags

Sightings

Nomenclature