p PatchFirst

CVE-2026-108752

CVE-2026-108752 · JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen

This page contains facts from public vulnerability sources. Check the original advisory before updating.

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.

CVSS 2.3 · Low · EPSS 0.2%

Published
Updated

Stack: system

Affected products and versions

  • jupyterhub

    Versions
    • ≥ 0, ≤ 6.0.1: Affected (semver)

    No fix published

  • jupyterhub Debian:12

    Versions
    • 3.0.0+ds1-1
    • 5.0.0+ds1-1
    • 5.0.0+ds1-2
    • 5.0.0+ds1-3
    • 5.0.0+ds1-4
    • 5.2.1+ds1-1
    • 5.2.1+ds1-2
    • 5.2.1+ds1-3
    • 5.2.1+ds1-4
    • 5.2.1+ds1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Debian:13

    Versions
    • 5.2.1+ds1-4
    • 5.2.1+ds1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Debian:14

    Versions
    • 5.2.1+ds1-4
    • 5.2.1+ds1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:22.04:LTS

    Versions
    • 2.0.0+ds1-1
    • 2.0.0+ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:24.04:LTS

    Versions
    • 3.0.0+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:26.10

    Versions
    • 5.2.1+ds1-4
    • 5.2.1+ds1-5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jupyterhub Ubuntu:26.04:LTS

    Versions
    • 5.2.1+ds1-4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →