Jupyter Lti Jupyterhub Authenticator vulnerabilities

2 vulnerabilities

Known vulnerabilities in Jupyter Lti Jupyterhub Authenticator, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.9CVE-2026-34052chainguardpy3.10-jupyterhub-ltiauthenticator+10
EPSS score
0.41%
LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. This issue has been patched in version 1.6.3.10CVE-2023-25574jupyterlti_jupyterhub_authenticator+2
EPSS score
0.36%
`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator` version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.