CVE-2021-41194: Improper Access Control in jupyterhub-firstuseauthenticator

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-10-28 · updated 2026-06-17
Weakness: CWE-284

Description

FirstUseAuthenticator is a JupyterHub authenticator that helps new users set their password on their first login to JupyterHub. When JupyterHub is used with FirstUseAuthenticator, a vulnerability in versions prior to 1.0.0 allows unauthorized access to any user's account if `create_users=True` and the username is known or guessed. One may upgrade to version 1.0.0 or apply a patch manually to mitigate the vulnerability. For those who cannot upgrade, there is no complete workaround, but a partial mitigation exists. One can disable user creation with `c.FirstUseAuthenticator.create_users = False`, which will only allow login with fully normalized usernames for already existing users prior to jupyterhub-firstuserauthenticator 1.0.0. If any users have never logged in with their normalized username (i.e. lowercase), they will still be vulnerable until a patch or upgrade occurs.

Affected products

jupyterhub firstuseauthenticator: before 1.0.0 — fixed in 1.0.0

How to fix

Upgrade to a fixed version: jupyterhub firstuseauthenticator 1.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-41194 or the next vulnerability affects your stack