{"action":"Upgrade oauthenticator to 16.3.1 or later.","affected":[{"fixed":"16.3.1","introduced":"0"}],"component":"oauthenticator","cve_ids":["CVE-2024-37300"],"ecosystem":"PyPI","epss":0.00405,"exploited":false,"fixed_versions":["16.3.1"],"ghsa_id":"GHSA-gprj-3p75-f996","id":"tcs_01M5KGV81SD246RQ0STBG5RW5D","modified_at":"2026-07-07T17:46:29.847756741Z","published_at":"2026-07-07T14:34:34.721678Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1711","https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-gprj-3p75-f996","https://nvd.nist.gov/vuln/detail/CVE-2024-37300","https://github.com/jupyterhub/oauthenticator/commit/d1aea05fa89f2beae15ab0fa0b0d071030f79654","https://github.com/jupyterhub/oauthenticator","https://jupyterhub.readthedocs.io/en/stable/howto/upgrading-v5.html#authenticator-allow-all-and-allow-existing-users","https://pypi.org/project/oauthenticator","https://github.com/advisories/GHSA-gprj-3p75-f996"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"PYSEC-2026-1711","url":"https://osv.dev/vulnerability/PYSEC-2026-1711"}],"summary":"Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0"}