CVE-2026-108752: JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen

Severity: medium (CVSS 4.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-11 · updated 2026-10-16
Weakness: CWE-694

Description

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.

Affected products

jupyterhub: through 6.0.1

References

https://github.com/jupyterhub/jupyterhub
https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/oauth/provider.py#L719-L754
https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L1174-L1186
https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L563-L567
https://hackmd.io/@haind/jupyterhub-oauth-client-id-cross-user-collision
https://www.vulncheck.com/advisories/jupyterhub-through-6.0.1-oauth-client-id-collision-via-unescaped-hyphen

Get alerted when CVE-2026-108752 or the next vulnerability affects your stack