CVE-2018-7206: JupyterHub OAuthenticator Group Whitelisting Bypass
Summary
CVE-2018-7206: An issue was discovered in Project Jupyter JupyterHub OAuthenticator 0.6.x before 0.6.2 and 0.7.x before 0.7.3. Affects oauthenticator across 3 version ranges.
>= 0.6, < 0.6.2
>= 0.7, < 0.7.3
< 1845c0e4b1bff3462c91c3108c85205acd3c75a2
Fixed in 0.6.2 or 0.7.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
JupyterHub OAuthenticator is an authentication module for JupyterHub, a multi-user server for Jupyter notebooks. It provides a way to authenticate users using various external authentication providers, such as GitLab. The OAuthenticator package is responsible for handling the authentication process. This vulnerability affects versions 0.6.x before 0.6.2 and 0.7.x before 0.7.3 of the OAuthenticator package.
Vulnerability Detail
The vulnerability in JupyterHub OAuthenticator allows users to bypass group whitelisting when using GitLab for access control. This means that even if a user is not a member of the whitelisted groups, they can still create accounts on the JupyterHub. While these users cannot access other users' accounts, they can create their own accounts linked to their GitLab account. It's important to note that this vulnerability only affects JupyterHub instances using GitLab group whitelisting. Other authentication methods are not affected.
How To Fix
Latest published version: 17.4.0 as of 22 Oct 2026
pip install --upgrade "oauthenticator==17.4.0"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 0.6, < 0.6.20.6.2pip install --upgrade "oauthenticator==0.6.2" -
>= 0.7, < 0.7.30.7.3pip install --upgrade "oauthenticator==0.7.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The JupyterHub OAuthenticator package versions 0.6.x before 0.6.2 and 0.7.x before 0.7.3 are vulnerable to a bypass of group whitelisting when using GitLab for access control. Users should upgrade to the fixed versions (0.6.2 or 0.7.3) to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for oauthenticator →
FAQ
JupyterHub OAuthenticator is an authentication module for JupyterHub that allows users to authenticate using external providers like GitLab.
Versions 0.6.x before 0.6.2 and 0.7.x before 0.7.3 of the OAuthenticator package are affected.
The vulnerability allows users to bypass group whitelisting and create accounts on JupyterHub, even if they are not members of the whitelisted groups.
No, this vulnerability only affects JupyterHub instances using GitLab group whitelisting. Other authentication methods are not affected.
To fix this vulnerability, upgrade to a fixed version of the OAuthenticator package (0.6.2 or 0.7.3).
Related vulnerabilities
Recent vulnerabilities recorded for oauthenticator.
