CVE-2026-108752— JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
Quick assessment
Affected
jupyterhub jupyterhub
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
JupyterHub 6.0.1 及以下版本存在一个标识符冲突漏洞，攻击者可以通过注册带有连字符的用户名，覆盖其他用户的命名服务器 OAuth 客户端。例如，拥有类似 名称的攻击者可以覆盖 用户的 服务器的客户端信息。通过停止自己的服务器，攻击者可以破坏 OAuth 登录功能并撤销其他用户的令牌。
Possible ATT&CK Techniques 1 AI
T1098 · Account ManipulationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| jupyterhub | jupyterhub | ≤ 6.0.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-108752
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
Source: CVE Program / CVE List V5
Vulnerability Description
JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
使用多个具有重复标识的资源
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| jupyterhub | jupyterhub | 0 ~ 6.0.1 | - |
|
II. Public POCs for CVE-2026-108752
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-108752
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-108752 (1)
Vendor Advisories for CVE-2026-108752 (1)
News Coverage for CVE-2026-108752 (1)
Other References for CVE-2026-108752 (1)
IV. Related Vulnerabilities
Same product: jupyterhub
-
CVE-2026-54338
JupyterHub: Unauthenticated Denial of Service via Unbounded -
CVE-2026-40864
JupyterHub: Cross-origin form POSTs bypass XSRF -
CVE-2026-33709
JupyterHub has an Open Redirect Vulnerability -
CVE-2024-41942
JupyterHub has a privilege escalation vulnerability with the -
CVE-2024-28233
XSS in JupyterHub via Self-XSS leveraged by Cookie Tossing
Same vendor: jupyterhub
-
CVE-2026-54338
JupyterHub: Unauthenticated Denial of Service via Unbounded -
CVE-2026-40864
JupyterHub: Cross-origin form POSTs bypass XSRF -
CVE-2026-34052
LTI JupyterHub Authenticator: Unbounded Memory Growth via No -
CVE-2026-33709
JupyterHub has an Open Redirect Vulnerability -
CVE-2026-33175
OAuthenticator: Authentication Bypass in Auth0OAuthenticator
Same weakness: CWE-694
-
CVE-2026-78359
Duplicate Identity / Identity Shadowing across CustomerUser -
CVE-2026-102634
SGLang through 0.5.20 Denial of Service via Duplicate bootst -
CVE-2026-71327
Traefik: Gateway API route identity collision allows cross-n -
CVE-2026-57024
Junos OS: MX with SPC3, SRX Series: Repeated VPN negotiation -
CVE-2026-5794
Vulnerability in Cryptobox allows an authenticated user to t
V. Comments for CVE-2026-108752
No comments yet