OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

The primary impact of this vulnerability is account takeover within JupyterHub environments. By leveraging an unverified email address in Auth0, an attacker can bypass the standard authentication process and impersonate legitimate users. This can lead to unauthorized access to sensitive data, modification of Jupyter notebooks, and potentially, lateral movement within the network if JupyterHub is integrated with other systems. The ability to control the username claim further exacerbates the risk, allowing attackers to create accounts with predictable or malicious usernames.

Organizations utilizing JupyterHub with oauthenticator for authentication, particularly those relying on Auth0 for identity management, are at risk. This includes research institutions, data science teams, and educational organizations where JupyterHub is used for collaborative coding and data analysis. Legacy JupyterHub deployments with older oauthenticator versions are especially vulnerable.

• python / JupyterHub:

import subprocess
result = subprocess.run(['pip', 'show', 'oauthenticator'], capture_output=True, text=True)
if 'Version' in result.stdout:
    version = result.stdout.split('Version: ')[1].split('\n')[0]
    if version < '17.4.0':
        print('Vulnerability detected: oauthenticator version is < 17.4.0')
else:
    print('oauthenticator not found.')

• python / JupyterHub: Check JupyterHub logs for login attempts using unverified email addresses from Auth0. • generic web: Monitor JupyterHub login endpoints for unusual activity or requests from suspicious IP addresses.

1. 2026-04-03Disclosure

   disclosure

1. Reserviert2026-03-17
2. Veröffentlicht2026-04-03
3. Geändert2026-04-07
4. EPSS aktualisiert2026-04-11

The recommended mitigation is to immediately upgrade oauthenticator to version 17.4.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily restricting access to JupyterHub based on verified email addresses within Auth0. Implement stricter authentication policies within Auth0 to minimize the risk of unverified email addresses being used for malicious purposes. Monitor JupyterHub logs for suspicious login attempts, particularly those associated with unverified email addresses.