5 results · Clear filters · Feed
-
Medium 4.2
JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the clie…
-
Medium 5.3
JupyterHub: Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticate…
-
Medium 5.4CVE-2026-40864 Public exploit
JupyterHub: Cross-origin form POSTs bypass XSRF
JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. In versions 4.1.0 through 5.4.4, XSRF protection (updated in 4.1.0) inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing …
-
Medium 5.1
JupyterHub has an Open Redirect Vulnerability
JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. Prior to version 5.4.4, an open redirect vulnerability in JupyterHub allows attackers to construct links which, when clicked, take users to the JupyterHub login page, …
-
Medium 4.5
Cross-Site Request Forgery in JupyterHub
JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add or remove a user account).