CVE-2026-33175 jupyterhub CVE debrief

Who should care

Users of JupyterHub with OAuthenticator configured to use email as the usrname_claim, especially those with Auth0 tenants, should verify their configurations and update to version 17.4.0 or later. Security teams and administrators responsible for maintaining JupyterHub and OAuthenticator installations should prioritize this update and review their current security posture.

Technical summary

The vulnerability exists in OAuthenticator prior to version 17.4.0. An attacker with an unverified email address on an Auth0 tenant can bypass authentication and potentially take over user accounts when email is used as the usrname_claim. This issue arises because OAuthenticator does not properly validate the email addresses of users, allowing an attacker to use any email address to log in, even if it is not verified. The issue is patched in version 17.4.0. Users should update to this version or later to mitigate the vulnerability. Additionally, users should verify their configurations, especially those using email as the usrname_claim, and monitor for suspicious login activity. Implementing compensating controls for Auth0 tenants and performing regular security audits can also help prevent exploitation.

Defensive priority

High

Recommended defensive actions

• Update OAuthenticator to version 17.4.0 or later
• Verify configurations using email as usrname_claim
• Monitor for suspicious login activity
• Consider compensating controls for Auth0 tenants
• Review and adjust security settings for JupyterHub and OAuthenticator
• Perform regular security audits to identify potential vulnerabilities
• Implement additional monitoring and logging to detect unusual activity

Evidence notes

The CVE record was published on 2026-04-03T22:16:26.483Z and last modified on 2026-07-24T22:10:00.140Z. The NVD entry is currently Analyzed. This information is based on the provided source corpus. Further verification is recommended to ensure accuracy.

Official resources