CVE-2026-33175: OAuthenticator: Authentication Bypass in Auth0OAuthenticator via Unverified Email Claims
Summary
An authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrnameclaim, this gives users control over their username and the possibility of account takeover.
Impact
This is an Authentication Bypass Vulnerability. Any Auth0 tenant leveraging the Auth0OAuthenticator mapping the email claim to the JupyterHub username is impacted. By default, Auth0 handles email verification as a user flag, not a hard block to authentication streams. If an attacker can register an account with the Auth0 tenant with an unverified email and knows the email of an existing user on the system, they can authenticate as that user.
Patches
- Upgrade oauthenticator to 17.4
Workarounds
- Check emailverified field in an Authenticator.postauthhook function - Do not use email as the username claim - Enforce email verification in auth0
Other sources
OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. Prior to version 17.4.0, an authentication bypass vulnerability in oauthenticator allows an attacker with an unverified email address on an Auth0 tenant to login to JupyterHub. When email is used as the usrnameclaim, this gives users control over their username and the possibility of account takeover. This issue has been patched in version 17.4.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/oauthenticatorto a version that resolves this vulnerability.Fixed in 17.4.0 - Upgrade
Upgrade
oauthenticatorto a version that resolves this vulnerability.Fixed in 17.4.0 - Configuration
In your Authenticator.post_auth_hook, check the Auth0OAuthenticator user's `email_verified` field and block/deny authentication when `email_verified` is not verified.
oauthenticator (Authenticator.post_auth_hook) email_verified = verified-only (check email_verified in Authenticator.post_auth_hook and deny/block auth when unverified) - Configuration
Do not map Auth0's `email` claim to the JupyterHub username (i.e., do not use `email` as the username claim). Use a different claim for the username mapping.
oauthenticator (Auth0OAuthenticator) username_claim = Do not use `email` as the username claim - Compensating control
Enforce email verification in Auth0 by configuring Auth0 to block/deny authentication until the email is verified (per the referenced Auth0 article: Enforce-Email-Verification-With-Sending-Email-After-Each-Denied-Access).