Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-33175

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:f9fe71c998fec0f1d4579d12be92d12260223805864b75bd7c1571affd4dc15a
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

cwe · 2 assertions

{"cweId":"CWE-290","description":"CWE-290: Authentication Bypass by Spoofing","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-287","description":"CWE-287: Improper Authentication","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"product":"oauthenticator","vendor":"jupyterhub","versions":[{"status":"affected","version":"< 17.4.0"}]}
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/metrics/0/cvssV3_1

CWE assertions

2 source assertions
{"cweId":"CWE-290","description":"CWE-290: Authentication Bypass by Spoofing","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-287","description":"CWE-287: Improper Authentication","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/problemTypes/0/descriptions/0

Source references

3 source assertions
{"name":"https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9","tags":["x_refsource_MISC"],"url":"https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/references/1
{"name":"https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0","tags":["x_refsource_MISC"],"url":"https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/references/2
{"name":"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv","tags":["x_refsource_CONFIRM"],"url":"https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a8cf2a53dc831a62f5cfb1846f0273519d3808f7d53add8f09c421a700c9a0b3 · sha256:d4355257bc529c5b… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer