CVE-2026-108752: JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this collision?
Deployments are exposed when a user can have a hyphenated username that collides with another user's username plus a named-server name. For example, a user named alice-prod can target the OAuth client associated with user alice's named server prod.
What access does an attacker need?
The attacker must be an authenticated JupyterHub user and must be able to register or hold a specially formed hyphenated username. No user interaction is required.
What is the practical impact of exploitation?
An attacker can overwrite another user's named-server OAuth client, causing OAuth login failures for that server. Stopping the attacker's own server can also revoke tokens associated with the affected client's replacement.