CVE-2024-29033High· 7.5▾ TwilightGoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.6%
Last analysed / modified upstream
GoogleOAuthenticator.hosted_domain is used to restrict what Google accounts can be authorized to access a JupyterHub. The restriction is intended to ensure Google accounts are part of one or more Google organizations/workspaces verified to control specified domain(s).
The vulnerability is that the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this blog post from 15th December 2023.
Upgrade to oauthenticator>=16.3.0 or restrict who can login another way, such as allowed_users or allowed_google_groups.
oauthenticator < 16.3.0Upgrade to a patched release:
oauthenticator 16.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-33175High· 8.8Auth0OAuthenticator has an Authentication Bypass via Unverified Email Claims
CVE-2024-37300High· 8.1Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
CVE-2020-26250Medium· 6.3Base class whitelist configuration ignored in OAuthenticator