Authentication Bypass in OAuthenticator for JupyterHub by Jupyter Project
CVE-2026-33175

8.8HIGH

Key Information:

Vendor: Jupyterhub
Status: Oauthenticator
Vendor: CVE Published:; 3 April 2026

What is CVE-2026-33175?

The OAuthenticator component used with JupyterHub is vulnerable to an authentication bypass. This allows an attacker with an unverified email address on an Auth0 tenant to log into JupyterHub, potentially leading to account takeover. When email is used as the username_claim feature, it gives attackers the ability to manipulate usernames. This vulnerability was addressed in version 17.4.0.