A cross-site request forgery (XSRF) bypass vulnerability exists in JupyterHub versions 4.1.0 through 5.4.4. The XSRF protection mechanism introduced in version 4.1.0 incorrectly classifies requests bearing the `Sec-Fetch-Mode: no-cors` header as same-origin, allowing XSRF checks to be bypassed. The JSON API is not affected; only HTTP form endpoints are impacted, specifically `/hub/spawn` and `/hub/accept- [truncated]
The LTI JupyterHub Authenticator vulnerability CVE-2026-34052 is a denial of service issue. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. This allows an attacker with knowledge of a valid consumer key to send repeated requests with unique nonces, gradually exhausting server memory. The CVE record was published on 2026-04-03T23:17:0 [truncated]
CVE-2026-33709 is an open redirect vulnerability in JupyterHub, a software allowing one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, attackers can construct links which, when clicked, take users to the JupyterHub login page and then send them to an arbitrary attacker-controlled site outside JupyterHub. This issue has been patched in version 5.4.4. Users of JupyterHub, espec [truncated]
CVE-2026-33175 is an authentication bypass vulnerability in OAuthenticator, a software allowing OAuth2 identity providers to be used with JupyterHub. The issue allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub when email is used as the usrname_claim, potentially leading to account takeover. This vulnerability has significant implications for users of JupyterHub [truncated]
