GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
Summary and impact
GoogleOAuthenticator.hosted_domain is used to restrict what Google accounts can be authorized to access a JupyterHub. The restriction is intended to ensure Google accounts are part of one or more Google organizations/workspaces verified to control specified domain(s).
The vulnerability is that the actual restriction has been to Google accounts with emails ending with the domain. Such accounts could have been created by anyone which at one time was able to read an email associated with the domain. This was described by Dylan Ayrey (@dxa4481) in this blog post from 15th December 2023.
Remediation
Upgrade to oauthenticator>=16.3.0 or restrict who can login another way, such as allowed_users or allowed_google_groups.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | oauthenticator | < 16.3.0 | 16.3.0 |
Referencias
- https://github.com/jupyterhub/oauthenticator/security/advisories/GHSA-55m3-44xf-hg4h
- https://nvd.nist.gov/vuln/detail/CVE-2024-29033
- https://github.com/jupyterhub/oauthenticator/commit/5246b09675501b09fb6ed64022099b7644812f60
- https://github.com/jupyterhub/oauthenticator
- https://trufflesecurity.com/blog/google-oauth-is-broken-sort-of
- https://pypi.org/project/oauthenticator
- https://github.com/advisories/GHSA-55m3-44xf-hg4h
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N- Debilidad (CWE)
CWE-285- Plataforma
- Python (PyPI)
- Paquete
oauthenticator- Publicada
- 20.03.2024
- Actualizado
- 11.10.2026 15:17
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-1710 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-55m3-44xf-hg4h - CC BY 4.0
Historial de vulnerabilidades: oauthenticator
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 6
- Primera → última
- 02.2018 04.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 5
- Media 1
Divulgaciones por año
- 2018: 1
- 2019: 0
- 2020: 1
- 2021: 0
- 2022: 1
- 2023: 0
- 2024: 2
- 2025: 0
- 2026: 1
-
GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.