Executive brief
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).
Affected products
- PyPI jupyterhub
Junglewise Threat Intelligence
CVE-2020-36191: PYSEC-2021-67 - JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add
CVE-2020-36191 · Severity: low · CVSS 3.1 · Published 2021-01-13
Technologies: jupyterhub (PyPI). Vendors: PyPI.
Related threats
- JupyterHub unauthenticated denial of service in login form handling
- PYSEC-2026-1480 - Cross site scripting (XSS) in JupyterHub via Self-XSS leveraged by Cookie Tossing
- PYSEC-2026-647 - Open Redirect vulnerability in jupyterhub and notebook
- JupyterHub XSRF protection bypass in HTTP form endpoints
- Jupyter JupyterHub open redirect vulnerability