https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T22:38:43.835841+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-00153 bdu:2026-00153 2026-10-09T22:38:43.886928+00:00 bdu:2026-00153 https://cve.radiocsirt.org/vuln/euvd-2026-218824 EUVD-2026-218824 2026-10-09T22:38:43.886964+00:00 EUVD-2026-218824 https://cve.radiocsirt.org/vuln/fkie_cve-2023-25574 fkie_cve-2023-25574 2026-10-09T22:38:43.886978+00:00

`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator` version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-mcgx-2gcr-p3hp GHSA-mcgx-2gcr-p3hp — LTI JupyterHub Authenticator does not properly validate JWT Signature 2026-10-09T22:38:43.887010+00:00

Affected: PyPI: jupyterhub-ltiauthenticator

### Impact

Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are influenced.

LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request granting access to existing and new user identities.

### Patches

None.

### Workarounds

None.

### References

- [This code segment](https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164) didn't validate a JWT signature.

 https://cve.radiocsirt.org/vuln/gsd-2023-25574 gsd-2023-25574 2026-10-09T22:38:43.887044+00:00 gsd-2023-25574 https://cve.radiocsirt.org/vuln/pysec-2025-120 PYSEC-2025-120 2026-10-09T22:38:43.887056+00:00

Affected: PyPI: jupyterhub-ltiauthenticator

`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator` version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.