CVE-2026-108752: JupyterHub OAuth Client ID Collision via Unescaped Hyphen
Summary
CVE-2026-108752: JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen. Affects jupyterhub versions < 6.1.0. Fixed in 6.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JupyterHub is an open-source platform that allows users to create and manage multi-user environments for Jupyter notebooks. It is widely used in educational and research settings to facilitate collaborative data science and programming. The platform supports various authentication methods, including OAuth, enabling users to log in securely. However, JupyterHub versions up to 6.0.1 are vulnerable to a specific issue that can compromise user authentication and server integrity.
Vulnerability Detail
The vulnerability arises from an identifier collision that occurs when authenticated users register a hyphenated username. For instance, a user with the username 'alice-prod' can overwrite the OAuth client for another user named 'alice' who has a server called 'prod'. This leads to unauthorized access, breaking OAuth login and revoking tokens, which can disrupt the affected user's server operations. The issue is rooted in the way JupyterHub handles hyphenated usernames without proper escaping, allowing for potential exploitation by malicious users.
How To Fix
Minimum fixed version
6.1.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using hyphenated usernames when registering for JupyterHub. This can help mitigate the risk of identifier collisions until the package is updated to a patched version.
Conclusion
The CVE-2026-108752 vulnerability in JupyterHub poses a significant risk to user authentication and server integrity due to identifier collisions with hyphenated usernames. It is crucial for users to update to version 6.1.0 or later to mitigate this risk. Until then, avoiding hyphenated usernames can serve as a temporary workaround.
See every vulnerability recorded for jupyterhub →
FAQ
The vulnerability allows an authenticated user to overwrite another user's OAuth client, potentially disrupting their access and server functionality.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
JupyterHub versions up to and including 6.0.1 are affected by this vulnerability.
Yes, the vulnerability is fixed in JupyterHub version 6.1.0 and later. It is recommended to upgrade to this version.
If an immediate update is not possible, refrain from using hyphenated usernames to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for jupyterhub.
