PyPI/oauthenticator CVE-2020-26250: medium 6.3, EPSS 1.13%

Base class whitelist configuration ignored in OAuthenticator

Action: Upgrade oauthenticator to 0.12.2 or later.

pip install oauthenticator==0.12.2

Affected

Fixed versions

Sources

• osv: GHSA-384w-5v3f-q499
• https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-384w-5v3f-q499
• https://nvd.nist.gov/vuln/detail/CVE-2020-26250
• https://github.com/jupyterhub/oauthenticator/commit/a4aac191c16cf6281f3d346615aefa75702b02d7
• https://github.com/jupyterhub/oauthenticator
• https://github.com/jupyterhub/oauthenticator/blob/master/docs/source/changelog.md#0122---2020-11-30
• https://github.com/pypa/advisory-database/tree/main/vulns/oauthenticator/PYSEC-2020-68.yaml
• https://jupyterhub.readthedocs.io/en/1.2.2/getting-started/authenticators-users-basics.html#add-or-remove-users-from-the-hub

CVE-2020-26250 · published 2020-12-01T20:25:00Z · modified 2026-07-08T06:28:40.187996966Z · JSON