Executive brief
OAuthenticator, a widely-used authentication module for JupyterHub that enables federated login via OAuth providers, fails to properly enforce user allowlist restrictions in versions 0.12.0 and 0.12.1. When administrators configure user access controls via the deprecated whitelist setting, the restriction is silently ignored, allowing any authenticated user to gain access regardless of the intended allowlist. This can result in unauthorized users accessing JupyterHub instances and associated computational resources.
Technical details
The vulnerability is an authorization bypass (CWE-863) affecting the configuration mapping layer in OAuthenticator. When JupyterHub 1.2 deprecated the `Authenticator.whitelist` setting in favor of `Authenticator.allowed_users`, OAuthenticator failed to transparently migrate the configuration value with a deprecation warning. Instead, the whitelist configuration is ignored, and if no provider-based restrictions (e.g., GitHub team/org membership) are configured, all OAuth-authenticated users are permitted. The vulnerability requires that the affected versions (0.12.0–0.12.1) be deployed with the deprecated whitelist configuration and no additional authorization controls in place. The fix is available in version 0.12.2 and the JupyterHub Helm chart 0.10.6, which properly implement configuration mapping.
Affected products
- JupyterHub OAuthenticator 0.12.0, 0.12.1
Timeline
- 2020-12-01: disclosed
- 2020-12-01: patched: version 0.12.2 released