CVE-2026-33175 - Vulnerability Analysis

Overview

OAuthenticator < 17.4.0 contains an authentication bypass caused by unverified email addresses on Auth0 tenants when email is used as username_claim, letting attackers login and potentially take over accounts, exploit requires unverified email on Auth0.

Severity & Score

Impact

Attackers can bypass authentication and take over user accounts, leading to unauthorized access.

Mitigation

Update to version 17.4.0 or later.

References

• https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9
• https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0
• https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner