{"action":"Upgrade oauthenticator to 17.4.0 or later.","affected":[{"fixed":"17.4.0","introduced":"0"}],"component":"oauthenticator","cve_ids":["CVE-2026-33175"],"ecosystem":"PyPI","epss":0.0064,"exploited":false,"fixed_versions":["17.4.0"],"ghsa_id":"GHSA-rrvg-cxh4-qhrv","id":"tcs_01M5KGY96YCVNCX1R01AXTE2PS","modified_at":"2026-07-13T07:15:50.511399138Z","published_at":"2026-04-03T22:16:26.483Z","references":["https://osv.dev/vulnerability/PYSEC-2026-2238","https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0","https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv","https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-2238","url":"https://osv.dev/vulnerability/PYSEC-2026-2238"}],"summary":"OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an"}