CVE-2026-33175
High · 8.8CVSS
8.8
EPSS
0.6%
Published
Apr 3, 2026
CISA due date
—
The record
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Chainguard | py3.10-oauthenticator | 0 | 17.4.0-r0 |
| Chainguard | py3.11-oauthenticator | 0 | 17.4.0-r0 |
| Chainguard | py3.12-oauthenticator | 0 | 17.4.0-r0 |
| Chainguard | py3.13-oauthenticator | 0 | 17.4.0-r0 |
| Wolfi | py3.10-oauthenticator | 0 | 17.4.0-r0 |
| Wolfi | py3.11-oauthenticator | 0 | 17.4.0-r0 |
| Wolfi | py3.12-oauthenticator | 0 | 17.4.0-r0 |
| Wolfi | py3.13-oauthenticator | 0 | 17.4.0-r0 |
Related vulnerabilities
- CVE-2026-114638 Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the… CWE-287
- CVE-2026-114639 Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass… CWE-287
- CVE-2026-112104 A flaw has been found in eremef bandcamp-player up to 1.8.33-beta. CWE-287
- CVE-2026-107228 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-287
- CVE-2026-86781 The SSL Zen — SSL Certificate Installer & HTTPS Redirects WordPress plugin before 4.7.40… CWE-287
- CVE-2026-14563 The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the… CWE-287
- CVE-2026-14559 The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's… CWE-287
- CVE-2026-88895 CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints… CWE-287