PyPI/oauthenticator CVE-2026-33175: high 8.8, EPSS 0.44%

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an

Action: Upgrade oauthenticator to 17.4.0 or later.

pip install oauthenticator==17.4.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-2238
• https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0
• https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv
• https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9

CVE-2026-33175 · published 2026-04-03T22:16:26.483Z · modified 2026-07-13T07:15:50.511399138Z · JSON