PyPI/jupyterhub-ltiauthenticator CVE-2023-25574: critical 10, EPSS 0.36%

LTI JupyterHub Authenticator does not properly validate JWT Signature

Action: Upgrade jupyterhub-ltiauthenticator to 1.4.0 or later.

pip install jupyterhub-ltiauthenticator==1.4.0

Affected

Fixed versions

Sources

• osv: GHSA-mcgx-2gcr-p3hp
• https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-mcgx-2gcr-p3hp
• https://nvd.nist.gov/vuln/detail/CVE-2023-25574
• https://github.com/jupyterhub/ltiauthenticator
• https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164
• https://github.com/jupyterhub/ltiauthenticator/blob/main/CHANGELOG.md#140---2023-03-01
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub-ltiauthenticator/PYSEC-2025-120.yaml

CVE-2023-25574 · published 2025-02-25T17:48:34Z · modified 2026-06-05T18:00:13.856174005Z · JSON