CVE-2026-33175
HIGHOAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims
Title source: cnaDescription
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv
X_Refsource_Misc x_refsource_misc
https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9
X_Refsource_Misc x_refsource_misc
https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0
Scores
CVSS v3
8.8
EPSS
0.0036
EPSS Percentile
27.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-287
CWE-290
Status
published
Products (3)
jupyter/oauthenticator
< 17.4.0
jupyterhub/oauthenticator
< 17.4.0
pypi/oauthenticator
0 - 17.4.0PyPI
Published
Apr 03, 2026
Tracked Since
Apr 04, 2026