CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
Authenticated users can overwrite other users' OAuth clients via hyphenated usernames, causing denial of service and token revocation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-108752?
CVE-2026-108752 is a low-severity vulnerability in jupyterhub, published on 11 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
Weakness: CWE-694
Which versions are affected by CVE-2026-108752?
1 open source package ship an affected version, including jupyterhub.
| Package | Affected | Fixed in |
|---|---|---|
jupyterhub Bitnami | All versions | 6.1.0 |
How do I fix CVE-2026-108752?
Upgrade jupyterhub to 6.1.0 or later.
Is CVE-2026-108752 being exploited?
There is no known exploitation of CVE-2026-108752 in the wild and no public exploit code.
Sources
Also known as BIT-jupyterhub-2026-108752, DEBIAN-CVE-2026-108752, GHSA-h63v-vvgj-vrfh, MINI-6h9x-f9mm-ppcp, UBUNTU-CVE-2026-108752.