Is CVE-2020-26250 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2020-26250 being exploited in the wild.

How severe is CVE-2020-26250?

Low severity, with a CVSS score of 3.1, published 1 December 2020.

Which products and versions are affected?

oauthenticator (PyPI) ECOSYSTEM:introduced=0.12.0,fixed=0.12.2, GIT:introduced=0,fixed=a4aac191c16cf6281f3d346615aefa75702b02d7|ECOSYSTEM:introduced=0.12.0,fixed=0.12.2.

Is there a fix for CVE-2020-26250?

Yes. oauthenticator (PyPI): upgrade to 0.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2020-26250 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2020-26250?

Check whether you run oauthenticator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2020-26250: JupyterHub OAuthenticator whitelist configuration bypass

CVE-2020-26250 · Severity: low · CVSS 3.1 · Published 2020-12-01

OAuthenticator, a widely-used authentication module for JupyterHub that enables federated login via OAuth providers, fails to properly enforce user allowlist restrictions in versions 0.12.0 and 0.12.1. When administrators configure user access controls via the deprecated whitelist setting, the restriction is silently ignored, allowing any authenticated user to gain access regardless of the intended allowlist. This can result in unauthorized users accessing JupyterHub instances and associated computational resources.

Technologies: oauthenticator (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2020-26250 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2020-26250 being exploited in the wild.
How severe is CVE-2020-26250?: Low severity, with a CVSS score of 3.1, published 1 December 2020.
Which products and versions are affected?: oauthenticator (PyPI) ECOSYSTEM:introduced=0.12.0,fixed=0.12.2, GIT:introduced=0,fixed=a4aac191c16cf6281f3d346615aefa75702b02d7|ECOSYSTEM:introduced=0.12.0,fixed=0.12.2.
Is there a fix for CVE-2020-26250?: Yes. oauthenticator (PyPI): upgrade to 0.12.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2020-26250 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2020-26250?: Check whether you run oauthenticator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

oauthenticator (PyPI): upgrade to 0.12.2 or later
```
pip install "oauthenticator>=0.12.2"
```

Technical details

The vulnerability is an authorization bypass (CWE-863) affecting the configuration mapping layer in OAuthenticator. When JupyterHub 1.2 deprecated the `Authenticator.whitelist` setting in favor of `Authenticator.allowed_users`, OAuthenticator failed to transparently migrate the configuration value with a deprecation warning. Instead, the whitelist configuration is ignored, and if no provider-based restrictions (e.g., GitHub team/org membership) are configured, all OAuth-authenticated users are permitted. The vulnerability requires that the affected versions (0.12.0–0.12.1) be deployed with the deprecated whitelist configuration and no additional authorization controls in place. The fix is available in version 0.12.2 and the JupyterHub Helm chart 0.10.6, which properly implement configuration mapping.

Affected products

JupyterHub OAuthenticator 0.12.0, 0.12.1

Identifiers

CVE-2020-26250
GHSA-384w-5v3f-q499
PYSEC-2020-68

Timeline

2020-12-01: disclosed
2020-12-01: patched: version 0.12.2 released

References

https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-384w-5v3f-q499

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.