CVE-2026-33175: OAuthenticator Auth Bypass Vulnerability

CVE-2026-33175 Overview

CVE-2026-33175 is an authentication bypass vulnerability affecting OAuthenticator, the software component that enables OAuth2 identity providers to integrate with JupyterHub. This vulnerability allows attackers with an unverified email address on an Auth0 tenant to bypass authentication controls and gain unauthorized access to JupyterHub instances. When email is configured as the username_claim, attackers can manipulate their username, potentially leading to account takeover scenarios.

Critical Impact

Attackers with unverified Auth0 email addresses can bypass authentication and potentially take over existing user accounts in JupyterHub environments.

Affected Products

• OAuthenticator versions prior to 17.4.0
• JupyterHub deployments using OAuthenticator with Auth0 identity provider
• Configurations using email as the username_claim setting

Discovery Timeline

• April 3, 2026 - CVE-2026-33175 published to NVD
• April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33175

Vulnerability Analysis

This authentication bypass vulnerability (CWE-287: Improper Authentication) stems from insufficient validation of email verification status when processing OAuth2 authentication responses from Auth0. The vulnerability is exploitable over the network with low attack complexity, requiring only low-level privileges to execute. An attacker who successfully exploits this vulnerability can achieve complete compromise of confidentiality, integrity, and availability of the affected JupyterHub instance.

The core issue lies in how OAuthenticator processes user identity claims from Auth0. When configured to use email as the username claim, the software fails to verify whether the email address has been validated by the identity provider before accepting it as a trusted identifier.

Root Cause

The root cause is improper authentication validation in OAuthenticator's handling of Auth0 identity provider responses. The software trusts the email claim from Auth0 without verifying the email_verified attribute, allowing users with unverified email addresses to authenticate. This design flaw enables attackers to register accounts with arbitrary email addresses on Auth0 tenants and use those unverified emails to impersonate legitimate users in JupyterHub.

Attack Vector

The attack vector is network-based, requiring the attacker to:

1. Register an account on the target Auth0 tenant with an email address matching an existing JupyterHub user
2. Intentionally avoid verifying the email address
3. Authenticate to the JupyterHub instance through the OAuth2 flow
4. OAuthenticator accepts the unverified email as the username, granting access to the victim's account

The vulnerability allows attackers to control their username claim value, which in environments where email is used as the primary identifier, translates directly to account impersonation and takeover capabilities. Technical details regarding the specific code changes can be found in the GitHub Commit Reference.

Detection Methods for CVE-2026-33175

Indicators of Compromise

• Unusual login patterns from users whose email addresses were recently added to the Auth0 tenant
• Authentication events where the email_verified claim is false or missing
• Multiple accounts attempting to authenticate with similar or identical email addresses
• Unexpected changes to user data or notebooks in JupyterHub following suspicious authentication events

Detection Strategies

• Monitor Auth0 authentication logs for login attempts with unverified email addresses
• Implement alerting on authentication events where email_verified is false or absent
• Audit JupyterHub user sessions for anomalous access patterns or geographic inconsistencies
• Review OAuthenticator configuration to identify deployments using email as username_claim

Monitoring Recommendations

• Enable detailed logging for OAuth2 authentication flows in JupyterHub
• Configure Auth0 to report email verification status in authentication logs
• Implement real-time alerting for authentication attempts with unverified credentials
• Establish baseline user behavior metrics to detect account takeover attempts

How to Mitigate CVE-2026-33175

Immediate Actions Required

• Upgrade OAuthenticator to version 17.4.0 or later immediately
• Audit current user sessions and force re-authentication for all active users
• Review Auth0 tenant settings to ensure email verification is enforced
• Consider changing username_claim configuration to a more secure identifier if email-based authentication is not required

Patch Information

The vulnerability has been addressed in OAuthenticator version 17.4.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix ensures proper validation of email verification status before accepting email claims as trusted identifiers.

For detailed patch information, see the GitHub Release Note and the GitHub Security Advisory.

Workarounds

• Configure Auth0 to require email verification before allowing authentication
• Switch username_claim to use a verified identifier such as sub (subject) instead of email
• Implement additional authorization checks at the application layer to validate user identity
• Temporarily disable Auth0 authentication if the patch cannot be applied immediately and alternative identity providers are available

# Configuration example - Update JupyterHub configuration to use verified identifier
# In jupyterhub_config.py, change the username_claim setting:
c.Auth0OAuthenticator.username_claim = 'sub'

# Or enforce email verification in your Auth0 tenant rules
# This requires configuring Auth0 Actions or Rules to reject unverified emails