PyPI/oauthenticator CVE-2024-37300: high 8.1, EPSS 0.40%

Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Action: Upgrade oauthenticator to 16.3.1 or later.

pip install oauthenticator==16.3.1

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1711
• https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-gprj-3p75-f996
• https://nvd.nist.gov/vuln/detail/CVE-2024-37300
• https://github.com/jupyterhub/oauthenticator/commit/d1aea05fa89f2beae15ab0fa0b0d071030f79654
• https://github.com/jupyterhub/oauthenticator
• https://jupyterhub.readthedocs.io/en/stable/howto/upgrading-v5.html#authenticator-allow-all-and-allow-existing-users
• https://pypi.org/project/oauthenticator
• https://github.com/advisories/GHSA-gprj-3p75-f996

CVE-2024-37300 · published 2026-07-07T14:34:34.721678Z · modified 2026-07-07T17:46:29.847756741Z · JSON