Skip to content
Sign in
5.9 Medium

CVE-2026-34052 LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI

Description

LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are added before signature validation, so an attacker with knowledge of a valid consumer key can send repeated requests with unique nonces to gradually exhaust server memory, causing a denial of service. This issue has been patched in version 1.6.3.

Affected products and versions

Product Affected versions Fixed in
ltiauthenticator 1.6 earliest → < 1.6.3 1.6.3

Other CVEs of ltiauthenticator

The 2 CVEs of ltiauthenticator →
CVE-2023-25574 `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI) 10.0 Critical
Track this CVE