CVE-2026-108752: 
JupyterHub Análisis y mitigación de vulnerabilidades

CVE-2026-108752 is an OAuth client identifier collision vulnerability in JupyterHub that allows authenticated users to overwrite another user's named-server OAuth client configuration by registering a specially crafted hyphenated username. For example, an attacker with the username alice-prod can collide with and overwrite the OAuth client registered for user alice's named server prod, breaking OAuth login and revoking tokens for the victim. All versions of JupyterHub through 6.0.1 are affected. The vulnerability was published on October 11, 2026, with a CVSS v3.1 base score of 4.2 (Medium) and a CVSS v4.0 base score of 2.3 (Low) (Github Advisory, VulnCheck).

The root cause is classified as CWE-694 (Use of Multiple Resources with Duplicate Identifier). In JupyterHub's spawner code (user.py), the OAuth client_id for a named server is constructed by concatenating the username and server name with a hyphen: jupyterhub-user-{username}-{server_name}. Because hyphens in usernames are not escaped or disambiguated from the separator hyphen, a user named alice-prod generates the same client_id (jupyterhub-user-alice-prod) as user alice's named server prod. When the attacker starts their own server, this colliding client ID is registered in the OAuth provider (oauth/provider.py), overwriting the existing OAuth client record for the victim's named server (Github Advisory, HackMD Write-up). Exploitation requires the attacker to be an authenticated JupyterHub user and to know (or guess) a target username and server name combination.

Successful exploitation allows an authenticated attacker to overwrite another user's named-server OAuth client configuration, effectively breaking OAuth login for the targeted user and revoking their existing authentication tokens. The impact is limited to integrity and availability — there is no confidentiality impact, as the attacker cannot read the victim's data or tokens. The attack can cause persistent denial of service for the targeted user's named server until an administrator intervenes to restore the correct OAuth client registration (Github Advisory, VulnCheck).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at the time of publication (Github Advisory). The EPSS score is 0.0, indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account on the target JupyterHub instance and knowledge of a victim's username and named server name, raising the practical bar for abuse.

1. Reconnaissance: Identify a JupyterHub instance running version 6.0.1 or earlier with named servers enabled (allow_named_servers = True). Enumerate or guess a target username (e.g., alice) and their named server name (e.g., prod).
2. Register a colliding username: Obtain or register an account on the JupyterHub instance with a username that concatenates the target username and server name with a hyphen (e.g., alice-prod). This may require administrator provisioning depending on the authenticator in use.
3. Start the attacker's server: Authenticate as alice-prod and start a (default) server. JupyterHub constructs the OAuth client_id as jupyterhub-user-alice-prod, which is identical to the client ID for user alice's named server prod.
4. Overwrite the victim's OAuth client: The spawner registration process in user.py and oauth/provider.py writes the attacker's OAuth client record under the colliding identifier, overwriting the victim's existing OAuth client configuration.
5. Trigger token revocation: Stop the attacker's own server. This action revokes the OAuth tokens associated with the now-overwritten client ID, invalidating the victim's active sessions and breaking their OAuth login for the named server prod (HackMD Write-up, Github Advisory).

• Logs: JupyterHub application logs showing an OAuth client registration for an identifier like jupyterhub-user-<username> being overwritten or re-created by a different user account; log entries showing unexpected token revocation events for a named server.
• Database: Unexpected changes to the OAuthClient table where the identifier field for a named server (e.g., jupyterhub-user-alice-prod) is associated with a different user than expected.
• User Reports: Target users reporting sudden inability to authenticate to their named server via OAuth, or unexpected session invalidation without a logout action.
• Account Activity: Presence of user accounts with hyphenated names that match the pattern <existing_user>-<existing_server_name>, particularly if recently created (HackMD Write-up).

Upgrade JupyterHub to a version released after 6.0.1 that addresses this vulnerability, as a patch is available per the GitHub Advisory. As a configuration-based workaround, administrators should implement input validation or username allowlisting to prevent users from registering hyphenated usernames that could collide with existing named-server identifiers. Additionally, monitoring OAuth client registrations for unexpected modifications and restricting who can create accounts on the JupyterHub instance reduces exposure (Github Advisory, VulnCheck).