Attack Chain

1. Attacker gains access to an Auth0 tenant and creates an account.
2. The attacker does not verify the email address associated with the Auth0 account.
3. JupyterHub is configured to use OAuthenticator for authentication, with email specified as the username_claim.
4. The attacker attempts to log in to JupyterHub using the unverified Auth0 account.
5. Due to the vulnerability in OAuthenticator versions prior to 17.4.0, the authentication bypass occurs, allowing the attacker to successfully log in.
6. The attacker gains unauthorized access to the JupyterHub environment.
7. Attacker leverages the compromised account to perform malicious activities, such as accessing sensitive data or modifying Jupyter notebooks.

Impact

Successful exploitation of CVE-2026-33175 allows unauthorized access to JupyterHub instances. This can lead to the compromise of sensitive data, modification of Jupyter notebooks, and potential disruption of services. The vulnerability impacts organizations that use OAuthenticator with Auth0 and rely on email as the username claim. The number of affected organizations is currently unknown.

Recommendation

• Upgrade OAuthenticator to version 17.4.0 or later to patch CVE-2026-33175.
• Review JupyterHub configurations to ensure that email is not used as the username_claim if possible.
• Implement multi-factor authentication (MFA) for JupyterHub accounts to mitigate the risk of account takeover.
• Monitor logs for suspicious login attempts from Auth0 accounts with unverified email addresses. Deploy the provided Sigma rule targeting process creation after successful authentication to detect suspicious activity.