PyPI/oauthenticator CVE-2026-33175: high 8.8, EPSS 0.45%
Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims
Action: Upgrade oauthenticator to 17.4.0 or later.
pip install oauthenticator==17.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 17.4.0 | - |
Fixed versions
| 17.4.0 |
Sources
- osv: GHSA-rrvg-cxh4-qhrv
- https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv
- https://nvd.nist.gov/vuln/detail/CVE-2026-33175
- https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9
- https://github.com/jupyterhub/oauthenticator
- https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0
- https://support.auth0.com/center/s/article/Enforce-Email-Verification-With-Sending-Email-After-Each-Denied-Access
CVE-2026-33175 · published · modified · JSON