{"action":"Upgrade oauthenticator to 16.3.0 or later.","affected":[{"fixed":"16.3.0","introduced":"0"}],"component":"oauthenticator","cve_ids":["CVE-2024-29033"],"ecosystem":"PyPI","epss":0.00589,"exploited":false,"fixed_versions":["16.3.0"],"ghsa_id":"GHSA-55m3-44xf-hg4h","id":"tcs_01M5KGV7VVBFCY74XSD8YG71G0","modified_at":"2026-07-07T17:46:29.832428448Z","published_at":"2026-07-07T11:45:35.960534Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1710","https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h","https://nvd.nist.gov/vuln/detail/CVE-2024-29033","https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60","https://github.com/jupyterhub/oauthenticator","https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of","https://pypi.org/project/oauthenticator","https://github.com/advisories/GHSA-55m3-44xf-hg4h"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-1710","url":"https://osv.dev/vulnerability/PYSEC-2026-1710"}],"summary":"GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace"}