CVE-2022-31027: Authorization Bypass Through User-Controlled Key in CILogonOAuthenticator oauthenticator
Summary
CVE-2022-31027: Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator oauthenticator. Affects oauthenticator versions < 15.0.0. Fixed in 15.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
CILogonOAuthenticator is a component provided by the OAuthenticator package, which enables users to log in to a JupyterHub using CILogon, a federated authentication provider. CILogon allows users to authenticate themselves through various Identity Providers (IdP), including educational institutions, research institutions, and popular platforms like GitHub, ORCID, Google, and Microsoft. The CILogonOAuthenticator restricts access to a JupyterHub based on the allowed_idps configuration trait, which is intended to be a list of domains representing authorized institutions. The authorization is validated by checking if the email domain provided by CILogon matches one of the domains listed in allowed_idps.
Vulnerability Detail
The vulnerability arises from the fact that CILogonOAuthenticator does not verify the actual IdP used by the user to log in, but only checks the email address provided. This means that a user can log in to a JupyterHub using a GitHub account with an email address set to <something>@berkeley.edu, and it will be treated as if they are logging in using the official UC Berkeley Identity Provider. This has two significant consequences: 1) Users can access a JupyterHub even if their access to the institution's IdP has been revoked or expired, and 2) If any of the hundreds of supported IdPs allow users to set unverified email addresses, an attacker could impersonate any user on any other IdP. While no such vulnerability has been identified so far, the potential risk exists.
How To Fix
Latest published version: 17.4.0 as of 22 Oct 2026
pip install --upgrade "oauthenticator==17.4.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
15.0.0
This is the first release that contains the fix.
pip install --upgrade "oauthenticator==15.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The vulnerability in CILogonOAuthenticator allows unauthorized access to JupyterHubs and potential impersonation of users. It is recommended to update the OAuthenticator package to the patched version 15.0.0 or above and modify the allowed_idps configuration trait to use EntityID values instead of domains. This ensures that only authorized IdPs are allowed for login. For further assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oauthenticator →
FAQ
CILogonOAuthenticator is a component provided by the OAuthenticator package that enables users to log in to a JupyterHub using CILogon, a federated authentication provider.
The allowed_idps configuration trait is used to specify the list of authorized institutions whose users can access the JupyterHub.
The vulnerability allows users to access a JupyterHub even if their access to the institution's IdP has been revoked or expired. It also opens the possibility of impersonating any user on any supported IdP if an IdP allows unverified email addresses.
No specific identity provider has been identified as vulnerable so far. However, since CILogon supports hundreds of IdPs, it is difficult to test them all.
To transition to the patched version, you need to update the OAuthenticator package to version 15.0.0 or above. Then, instead of specifying domains in the allowed_idps configuration trait, you should use the EntityID values of the IdPs allowed for login, which can be obtained from the list maintained by CILogon.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauthenticator.
