CVE-2026-108752
LOW
2,3
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Confidentiality: N/A
Integrity: N/A
Availability: N/A
MEDIUM
4,2
Source: [email protected]
Attack Vector: network
Attack Complexity: high
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: none
Integrity: low
Availability: low
Description
AI Translation Available
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
694
Use of Multiple Resources with Duplicate Identifier
IncompleteCommon Consequences
Security Scopes Affected:
Access Control
Other
Potential Impacts:
Bypass Protection Mechanism
Quality Degradation
Applicable Platforms
All platforms may be affected
https://github.com/jupyterhub/jupyterhub
https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d…
https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d…
https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d…
https://hackmd.io/@haind/jupyterhub-oauth-client-id-cross-user-collision
https://www.vulncheck.com/advisories/jupyterhub-through-6.0.1-oauth-client-id-c…