CVE-2024-37300: 
Python vulnerability analysis and mitigation

OAuthenticator is software that allows OAuth2 identity providers to be plugged in and used with JupyterHub. A vulnerability was discovered in JupyterHub < 5.0 when used with GlobusOAuthenticator, where the identity_provider restriction could be bypassed when used with allow_all configuration. The issue was assigned CVE-2024-37300 and has a CVSS v3.1 base score of 8.1 (HIGH) (GitHub Advisory).

Prior to JupyterHub 5.0, when using GlobusOAuthenticator, administrators could restrict access to users from a specific institution by configuring identity_provider along with allow_all = True. This configuration worked as expected before version 5.0. However, in JupyterHub 5.0, allow_all takes precedence over identity_provider, effectively ignoring the institution restriction and allowing all users to login regardless of their identity provider (GitHub Advisory).

When using JupyterHub 5.0 with the affected configuration, the system would allow any user to login regardless of their institutional affiliation, potentially granting access to unauthorized users. This breaks the intended access control mechanism that was meant to restrict access to users from specific institutions (GitHub Advisory).

The issue has been fixed in OAuthenticator version 16.3.1. As a workaround, users are advised not to upgrade to JupyterHub 5.0 when using GlobusOAuthenticator with the affected configuration until they can upgrade to the patched version (GitHub Advisory).