# CVE-2022-31027: Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator

Source: https://junglewise.ai/threats/cve-2022-31027-authorization-bypass-through-user-controlled-key-when-using  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-06-09  
License: CC BY 4.0 with a link back

CVE-2022-31027 · Severity: low · CVSS 3.1 · Published 2022-06-09

OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log in to a JupyterHub via CILogon. This is primarily used to restrict a JupyterHub only to users of a given institute. The allowed_idps configuration trait of CILogonOAuthenticator is documented to be a list of domains that indicate the institutions whose users are authorized to access this JupyterHub. This authorization is validated by ensuring that the *email* field provided to us by CILogon has a *domain* that matches one of the domains listed in `allowed_idps`.If `allowed_idps` contains `berkeley.edu`, you might expect only users with valid current credentials provided by University of California, Berkeley to be able to access the JupyterHub. However, CILogonOAuthenticator does *not* verify which provider is used by the user to login, only the email address provided. So a user can login with a GitHub account that has email set to `<something>@berkeley.edu`, and that will be treated exactly the same as someone logging in using the UC Berkeley official Identity Provider. The patch fixing this issue makes a *breaking change* in how `allowed_idps` is interpreted. It's no longer a list of domains, but configuration representing the `EntityID` of the IdPs that are allowed, picked from the [list maintained by CILogon](https://cilogon.org/idplist/). Users are advised to upgrade.

Technologies: [oauthenticator (PyPI)](https://junglewise.ai/threats/technologies/oauthenticator). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2022-31027 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-31027 being exploited in the wild.

**How severe is CVE-2022-31027?** Low severity, with a CVSS score of 3.1, published 9 June 2022.

**Which products and versions are affected?** oauthenticator (PyPI) ECOSYSTEM:introduced=0,fixed=15.0.0.

**Is there a fix for CVE-2022-31027?** Yes. oauthenticator (PyPI): upgrade to 15.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2022-31027?** Check whether you run oauthenticator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oauthenticator (PyPI): upgrade to 15.0.0 or later

  ```sh
  pip install "oauthenticator>=15.0.0"
  ```


## Affected products

- oauthenticator (PyPI) ECOSYSTEM:introduced=0,fixed=15.0.0

## Identifiers

- CVE-2022-31027
- GHSA-r7v4-jwx9-wx43
- PYSEC-2022-206

## Related threats

- [PYSEC-2026-1711 - Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0](https://junglewise.ai/threats/cve-2024-37300-globus-identity-provider-restriction-ignored-when-used-with-allow)
- [JupyterHub OAuthenticator authentication bypass in Auth0OAuthenticator](https://junglewise.ai/threats/cve-2026-33175-jupyterhub-oauthenticator-authentication-bypass-in)
- [JupyterHub GoogleOAuthenticator improper authorization in hosted_domain check](https://junglewise.ai/threats/cve-2024-29033-jupyterhub-googleoauthenticator-improper-authorization-in-hosted)
- [JupyterHub OAuthenticator whitelist configuration bypass](https://junglewise.ai/threats/cve-2020-26250-jupyterhub-oauthenticator-whitelist-configuration-bypass)
- [JupyterHub OAuthenticator elevation of privilege](https://junglewise.ai/threats/cve-2018-7206-jupyterhub-oauthenticator-elevation-of-privilege)