{"action":"Upgrade jupyterhub-ltiauthenticator to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"1.3.0"}],"component":"jupyterhub-ltiauthenticator","cve_ids":["CVE-2023-25574"],"ecosystem":"PyPI","epss":0.00355,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-mcgx-2gcr-p3hp","id":"tcs_01M5KFQVQY524G6E3APZK590QE","modified_at":"2026-06-05T18:00:13.856174005Z","published_at":"2025-02-25T17:48:34Z","references":["https://osv.dev/vulnerability/GHSA-mcgx-2gcr-p3hp","https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-mcgx-2gcr-p3hp","https://nvd.nist.gov/vuln/detail/CVE-2023-25574","https://github.com/jupyterhub/ltiauthenticator","https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164","https://github.com/jupyterhub/ltiauthenticator/blob/main/CHANGELOG.md#140---2023-03-01","https://github.com/pypa/advisory-database/tree/main/vulns/jupyterhub-ltiauthenticator/PYSEC-2025-120.yaml"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-mcgx-2gcr-p3hp","url":"https://osv.dev/vulnerability/GHSA-mcgx-2gcr-p3hp"}],"summary":"LTI JupyterHub Authenticator does not properly validate JWT Signature"}