CVE-2026-33175
2 advisories.
PyPI/oauthenticator CVE-2026-33175: high 8.8
Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims
Action: Upgrade oauthenticator to 17.4.0 or later.
pip install oauthenticator==17.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 17.4.0 | - |
Fixed versions
| 17.4.0 |
Sources
- osv: GHSA-rrvg-cxh4-qhrv
- https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv
- https://nvd.nist.gov/vuln/detail/CVE-2026-33175
- https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9
- https://github.com/jupyterhub/oauthenticator
- https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0
- https://support.auth0.com/center/s/article/Enforce-Email-Verification-With-Sending-Email-After-Each-Denied-Access
CVE-2026-33175 · published · modified · JSON
PyPI/oauthenticator CVE-2026-33175: high 8.8
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an
Action: Upgrade oauthenticator to 17.4.0 or later.
pip install oauthenticator==17.4.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 17.4.0 | - |
Fixed versions
| 17.4.0 |
Sources
- osv: PYSEC-2026-2238
- https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0
- https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv
- https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9
CVE-2026-33175 · published · modified · JSON