CVE-2026-108752Published
JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen
Exact source revision recorded 23 Oct 2026 15:48:27 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-108752 · Microsoft / collected KEV context
cve-program · CVE-2026-108752
- https://hackmd.io/@haind/jupyterhub-oauth-client-id-cross-user-collision
- https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L563-L567
- https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/oauth/provider.py#L719-L754
- https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L1174-L1186
- https://github.com/jupyterhub/jupyterhub
- https://www.vulncheck.com/advisories/jupyterhub-through-6.0.1-oauth-client-id-collision-via-unescaped-hyphen
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.