CVE-2023-25574

PyPI/jupyterhub-ltiauthenticator CVE-2023-25574: critical 10

LTI JupyterHub Authenticator does not properly validate JWT Signature

Action: Upgrade jupyterhub-ltiauthenticator to 1.4.0 or later.

pip install jupyterhub-ltiauthenticator==1.4.0

Affected

Fixed versions

Sources

• osv: GHSA-mcgx-2gcr-p3hp
• https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-mcgx-2gcr-p3hp
• https://nvd.nist.gov/vuln/detail/CVE-2023-25574
• https://github.com/jupyterhub/ltiauthenticator
• https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164
• https://github.com/jupyterhub/ltiauthenticator/blob/main/CHANGELOG.md#140---2023-03-01
• https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub-ltiauthenticator/PYSEC-2025-120.yaml

CVE-2023-25574 · published 2025-02-25T17:48:34Z · modified 2026-06-05T18:00:13.856174005Z · JSON

PyPI/jupyterhub-ltiauthenticator CVE-2023-25574: critical 9.8

`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating J

Action: No fix published. Pin and monitor.

Affected

Fixed versions

No fixed version in the source.

Sources

• osv: PYSEC-2025-120
• https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164
• https://github.com/jupyterhub/ltiauthenticator/blob/main/CHANGELOG.md#140---2023-03-01
• https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-mcgx-2gcr-p3hp

CVE-2023-25574 · published 2025-02-25T15:15:16.227Z · modified 2026-05-21T15:00:14.269578987Z · JSON