CVE-2026-108752: OAuth client ID collision lets

CISO Take

JupyterHub through 6.0.1 builds OAuth client IDs for named servers without escaping hyphens, so an authenticated user who registers a name like alice-prod can overwrite the OAuth client of alice's server prod. The practical result is broken OAuth login and token revocation for the victim's server, not data theft or code execution. Severity is medium (CVSS 4.2) with high attack complexity and low privileges required, and there is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so near-term exploitation likelihood is low. The exposure is greatest for multi-tenant JupyterHub deployments that let users self-register or choose usernames. Apply the upstream fix once released, and in the meantime restrict username patterns to disallow hyphens or use an authenticator that normalizes usernames.

Sources:NVDVulnCheckGitHub

What is the risk?

Low-to-moderate. The CVSS vector (AV:N/AC:H/PR:L/UI:N/C:N/I:L/A:L) reflects the need for an authenticated account and a precise username and server-name collision. Impact is limited to integrity and availability of per-server OAuth clients. There is no confidentiality impact, no known exploitation, and no public PoC. Risk rises in shared data-science platforms where usernames are user-chosen and named servers are common (for example, notebooks used for model training and experimentation).

How does the attack unfold?

Initial Access

Attacker holds a low-privilege authenticated account on a shared JupyterHub and registers a hyphenated username such as alice-prod.

AML.T0012

Exploitation

The colliding client ID overwrites the OAuth client of alice's named server prod.

Impact

Stopping the attacker's own server removes the client and revokes the victim's tokens, breaking login and disrupting work.

AML.T0029

Initial Access

Attacker holds a low-privilege authenticated account on a shared JupyterHub and registers a hyphenated username such as alice-prod.

AML.T0012

Exploitation

The colliding client ID overwrites the OAuth client of alice's named server prod.

Impact

Stopping the attacker's own server removes the client and revokes the victim's tokens, breaking login and disrupting work.

AML.T0029

How severe is it?

CVSS 3.1

4.2 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 16% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CNone

ILow

ALow

What should I do?

1 step

1) Upgrade JupyterHub to a patched release once the maintainers publish a fix beyond 6.0.1, and track the upstream repository and the VulnCheck advisory. 2) Until patched, restrict usernames so they cannot contain hyphens, or restrict named-server names, via authenticator username patterns or allowlists. 3) Disable self-registration and limit named servers to trusted users. 4) Audit existing users and named servers for ambiguous pairs, for example user 'alice-prod' alongside user 'alice' with a server 'prod'. 5) Monitor for unexpected OAuth client deletions, repeated login failures on named servers, and unexpected token revocations in hub logs.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassDoSFrameworkAML.T0012- Valid Accounts AML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks are managed

Frequently Asked Questions

What is CVE-2026-108752?

JupyterHub through 6.0.1 builds OAuth client IDs for named servers without escaping hyphens, so an authenticated user who registers a name like alice-prod can overwrite the OAuth client of alice's server prod. The practical result is broken OAuth login and token revocation for the victim's server, not data theft or code execution. Severity is medium (CVSS 4.2) with high attack complexity and low privileges required, and there is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so near-term exploitation likelihood is low. The exposure is greatest for multi-tenant JupyterHub deployments that let users self-register or choose usernames. Apply the upstream fix once released, and in the meantime restrict username patterns to disallow hyphens or use an authenticator that normalizes usernames.

Is CVE-2026-108752 actively exploited?

No confirmed active exploitation of CVE-2026-108752 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-108752?

1) Upgrade JupyterHub to a patched release once the maintainers publish a fix beyond 6.0.1, and track the upstream repository and the VulnCheck advisory. 2) Until patched, restrict usernames so they cannot contain hyphens, or restrict named-server names, via authenticator username patterns or allowlists. 3) Disable self-registration and limit named servers to trusted users. 4) Audit existing users and named servers for ambiguous pairs, for example user 'alice-prod' alongside user 'alice' with a server 'prod'. 5) Monitor for unexpected OAuth client deletions, repeated login failures on named servers, and unexpected token revocations in hub logs.

What systems are affected by CVE-2026-108752?

This vulnerability affects the following AI/ML architecture patterns: Multi-tenant notebook platforms, Training pipelines, Shared ML development environments.

What is the CVSS score for CVE-2026-108752?

CVE-2026-108752 has a CVSS v3.1 base score of 4.2 (MEDIUM). The EPSS exploitation probability is 0.24%.

What is the AI security impact?

Affected AI Architectures

Multi-tenant notebook platformsTraining pipelinesShared ML development environments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.

Exploitation Scenario

An attacker with a low-privilege account on a shared JupyterHub registers the username 'alice-prod' and starts a server. The hub derives a client ID that collides with the one for alice's named server 'prod', overwriting the legitimate OAuth client. Alice can no longer complete OAuth login to her prod server. When the attacker stops their own server, the shared client is removed and Alice's tokens are revoked, interrupting her training jobs and notebook sessions.

Weaknesses (CWE)

CWE-694Use of Multiple Resources with Duplicate IdentifierPrimary CWE-694Use of Multiple Resources with Duplicate Identifier

CWE-694 — Use of Multiple Resources with Duplicate Identifier: The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.

[Architecture and Design] Where possible, use unique identifiers. If non-unique identifiers are detected, then do not operate any resource with a non-unique identifier and report the error appropriately.

Source: MITRE CWE corpus.