CVE-2026-33175: jupyter oauthenticator Improper Authentication
Vulnerability summary
CVE-2026-33175 is a high (CVSS 8.8) Improper Authentication vulnerability in jupyter oauthenticator. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.7% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 0 · Related 1Timeline
- 03-04-2026PublishedVulnerability first disclosed.
- 07-04-2026Last modifiedVulnerability information updated.
Description
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.
CVSS metrics
5 scores · 5 sources · 1 version- OSV · PypiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
+0.20 pp
From 0.44% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-290Authentication Bypass by SpoofingThis attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
Affected systems
Chainguard4 products
- py3.10-oauthenticator< 17.4.0-r0
- py3.11-oauthenticator< 17.4.0-r0
- py3.12-oauthenticator< 17.4.0-r0
- py3.13-oauthenticator< 17.4.0-r0
Wolfi4 products
- py3.10-oauthenticator< 17.4.0-r0
- py3.11-oauthenticator< 17.4.0-r0
- py3.12-oauthenticator< 17.4.0-r0
- py3.13-oauthenticator< 17.4.0-r0
Jupyter1 product
- oauthenticator< 17.4.0
Jupyterhub1 product
- oauthenticator< 17.4.0
PyPI1 product
- oauthenticator< 17.4.0
5 vendors · 11 products
References
7 links- github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrvX Refsource CONFIRMWEBAdvisoryMitigationVendor Advisory
- github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9X Refsource MISCWEBFIXPatch
