Skip to content
Sign in
8.1 High

CVE-2024-37300 OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub

Description

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. JupyterHub < 5.0, when used with `GlobusOAuthenticator`, could be configured to allow all users from a particular institution only. This worked fine prior to JupyterHub 5.0, because `allow_all` did not take precedence over `identity_provider`. Since JupyterHub 5.0, `allow_all` does take precedence over `identity_provider`. On a hub with the same config, now all users will be allowed to login, regardless of `identity_provider`. `identity_provider` will basically be ignored. This is a documented change in JupyterHub 5.0, but is likely to catch many users by surprise. OAuthenticator 16.3.1 fixes the issue with JupyterHub 5.0, and does not affect previous versions. As a workaround, do not upgrade to JupyterHub 5.0 when using `GlobusOAuthenticator` in the prior configuration.

Affected products and versions

Product Affected versions Fixed in
oauthenticator 16.3 earliest → < 16.3.1 16.3.1

Other CVEs of oauthenticator

The 5 CVEs of oauthenticator →
CVE-2026-33175 OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub 8.8 High CVE-2024-29033 OAuthenticator provides plugins for JupyterHub to use common OAuth providers, as well as base classes for writing… 7.5 High CVE-2022-31027 OAuthenticator is an OAuth token library for the JupyerHub login handler 4.2 Medium CVE-2020-26250 OAuthenticator is an OAuth login mechanism for JupyterHub 6.3 Medium
Track this CVE