Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

oauthenticator

6 known vulnerabilities (3 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 high, 2 medium
Weekly downloads
11.9K
Dependents
18
Registry
PyPI

Advisories 6

  • OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims

    Affected: fixed in 17.4.0.

  • Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

    Affected: fixed in 16.3.1.

  • GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace

    Affected: fixed in 16.3.0.

  • CVE-2022-31027Medium 4.2

    Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticator

    Affected: fixed in 15.0.0.

  • CVE-2020-26250Medium 6.3

    Base class whitelist configuration ignored in OAuthenticator

    Affected: from 0.12.0, fixed in 0.12.2.

  • An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3.

    Affected: from 0.6, fixed in 0.6.2; from 0.7, fixed in 0.7.3; from 0.6, fixed in 0.6.2; from 0.7, fixed in 0.7.3.