{"action":"Upgrade oauthenticator to 17.4.0 or later.","affected":[{"fixed":"17.4.0","introduced":"0"}],"component":"oauthenticator","cve_ids":["CVE-2026-33175"],"ecosystem":"PyPI","epss":0.00446,"exploited":false,"fixed_versions":["17.4.0"],"ghsa_id":"GHSA-rrvg-cxh4-qhrv","id":"tcs_01M5KFYKN3VCHZ1AYGV8DGM7VJ","modified_at":"2026-09-10T03:51:03.184847435Z","published_at":"2026-04-03T21:35:37Z","references":["https://osv.dev/vulnerability/GHSA-rrvg-cxh4-qhrv","https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv","https://nvd.nist.gov/vuln/detail/CVE-2026-33175","https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9","https://github.com/jupyterhub/oauthenticator","https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0","https://support.auth0.com/center/s/article/Enforce-Email-Verification-With-Sending-Email-After-Each-Denied-Access"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"GHSA-rrvg-cxh4-qhrv","url":"https://osv.dev/vulnerability/GHSA-rrvg-cxh4-qhrv"}],"summary":"Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims"}