GHSA-mcgx-2gcr-p3hp

Source

https://github.com/advisories/GHSA-mcgx-2gcr-p3hp

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mcgx-2gcr-p3hp/GHSA-mcgx-2gcr-p3hp.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mcgx-2gcr-p3hp

Aliases

Published

2025-02-25T17:48:34Z

Modified

2026-05-20T08:11:27.219813694Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

LTI JupyterHub Authenticator does not properly validate JWT Signature

Details

Impact

Only users that has configured a JupyterHub installation to use the authenticator class LTI13Authenticator are influenced.

LTI13Authenticator that was introduced in jupyterhub-ltiauthenticator 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request granting access to existing and new user identities.

Patches

None.

Workarounds

None.

References

This code segment didn't validate a JWT signature.

Database specific

{
    "github_reviewed": true,
    "severity": "CRITICAL",
    "nvd_published_at": "2025-02-25T15:15:16Z",
    "cwe_ids": [
        "CWE-347"
    ],
    "github_reviewed_at": "2025-02-25T17:48:34Z"
}

References

Affected packages

PyPI / jupyterhub-ltiauthenticator

Package

Name: jupyterhub-ltiauthenticator; View open source insights on deps.dev
Purl: pkg:pypi/jupyterhub-ltiauthenticator

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1.3.0

Fixed

1.4.0

Affected versions

1.*

1.3.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-mcgx-2gcr-p3hp/GHSA-mcgx-2gcr-p3hp.json"