# CVE-2026-33175: JupyterHub OAuthenticator authentication bypass in Auth0OAuthenticator

Source: https://junglewise.ai/threats/cve-2026-33175-jupyterhub-oauthenticator-authentication-bypass-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-03. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-33175 · Severity: high · CVSS 8.8 · Published 2026-04-03

JupyterHub OAuthenticator, a tool used to manage user logins via external identity providers, contains a security flaw when used with Auth0. An attacker can use an unverified email address to impersonate a legitimate user, potentially gaining full access to that user's account and data. This could lead to unauthorized access to sensitive research environments or corporate data stored within JupyterHub.

Technologies: [oauthenticator (PyPI)](https://junglewise.ai/threats/technologies/oauthenticator). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-33175 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33175 being exploited in the wild.

**How severe is CVE-2026-33175?** High severity, with a CVSS score of 8.8, published 3 April 2026.

**Which products and versions are affected?** oauthenticator (PyPI) ECOSYSTEM:introduced=0,fixed=17.4.0.

**Is there a fix for CVE-2026-33175?** Yes. oauthenticator (PyPI): upgrade to 17.4.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33175 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33175?** Check whether you run oauthenticator (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- oauthenticator (PyPI): upgrade to 17.4.0 or later

  ```sh
  pip install "oauthenticator>=17.4.0"
  ```


## Technical details

An authentication bypass vulnerability exists in the Auth0OAuthenticator component of JupyterHub's OAuthenticator library. The root cause is the failure to validate the 'email_verified' claim from Auth0 identity tokens. When the 'username_claim' is configured to use the email address, an attacker can register an account on the Auth0 tenant with a victim's email address; even if unverified, OAuthenticator accepts the identity, leading to account takeover. This requires the attacker to have basic registration privileges on the same Auth0 tenant used by the JupyterHub instance. The issue is resolved in version 17.4.0 by enforcing the 'email_verified' check.

## Affected products

- JupyterHub oauthenticator < 17.4.0

## Identifiers

- CVE-2026-33175
- GHSA-rrvg-cxh4-qhrv
- PYSEC-2026-2238

## Timeline

- 2026-03-26: patched: Version 17.4.0 released
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE-2026-33175 published to NVD

## References

- [https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9](https://github.com/jupyterhub/oauthenticator/commit/f0c7002dc36e41efae0f674033cf7888a21d96f9)
- [https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0](https://github.com/jupyterhub/oauthenticator/releases/tag/17.4.0)
- [https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv](https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-rrvg-cxh4-qhrv)

## Related threats

- [PYSEC-2026-1711 - Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0](https://junglewise.ai/threats/cve-2024-37300-globus-identity-provider-restriction-ignored-when-used-with-allow)
- [JupyterHub GoogleOAuthenticator improper authorization in hosted_domain check](https://junglewise.ai/threats/cve-2024-29033-jupyterhub-googleoauthenticator-improper-authorization-in-hosted)
- [Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator](https://junglewise.ai/threats/cve-2022-31027-authorization-bypass-through-user-controlled-key-when-using)
- [JupyterHub OAuthenticator whitelist configuration bypass](https://junglewise.ai/threats/cve-2020-26250-jupyterhub-oauthenticator-whitelist-configuration-bypass)
- [JupyterHub OAuthenticator elevation of privilege](https://junglewise.ai/threats/cve-2018-7206-jupyterhub-oauthenticator-elevation-of-privilege)