CVE-2026-33175 OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

What is CVE-2026-33175?

CVE-2026-33175 is a high-severity authentication bypass vulnerability in jupyterhub oauthenticator, published on 3 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrname_claim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.

Weakness: CWE-290, CWE-287

Which versions are affected by CVE-2026-33175?

3 open source packages ship an affected version, including oauthenticator. It affects 1 product.

Products include Jupyter Oauthenticator.

How do I fix CVE-2026-33175?

Upgrade oauthenticator to 17.4.0 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2026-33175 being exploited?

There is no known exploitation of CVE-2026-33175 in the wild and no public exploit code.

Other vulnerabilities in jupyterhub oauthenticator

• CVE-2018-7206 JupyterHub OAuthenticator elevation of privilege High 8.8
• CVE-2024-29033 GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace High 7.5
• CVE-2020-26250 Base class whitelist configuration ignored in OAuthenticator Medium 6.3
• CVE-2022-31027 Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator Medium 4.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-ZW90347, GHSA-rrvg-cxh4-qhrv, PYSEC-2026-2238.