Executive brief
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
Affected products
- PyPI oauthenticator
Junglewise Threat Intelligence
CVE-2024-37300: PYSEC-2026-1711 - Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
CVE-2024-37300 · Severity: low · CVSS 3.1 · Published 2026-07-07
Technologies: oauthenticator (PyPI). Vendors: PyPI.
Related threats
- JupyterHub OAuthenticator authentication bypass in Auth0OAuthenticator
- JupyterHub GoogleOAuthenticator improper authorization in hosted_domain check
- PYSEC-2022-206 - OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, a
- PYSEC-2020-68 - OAuthenticator is an OAuth login mechanism for JupyterHub. In oauthenticator from version 0.12.0 and before 0.12.2, the deprecated (in jupyt
- PYSEC-2018-68 - An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. When using JupyterHub with G