JupyterHub LTI13Authenticator failed to validate JWT signatures
JupyterHub's LTI13Authenticator failed to validate JWT signatures, potentially allowing attackers to forge authentication requests and gain unauthorized access to user accounts. The vulnerability was patched in version 1.4.0.
What happened
LTI13Authenticator, introduced in jupyterhub-ltiauthenticator version 1.3.0, did not validate JWT signatures on incoming requests.
This vulnerability could allow an attacker to forge LTI 1.3 requests and gain unauthorized access to existing and new user identities.
Reported impact
The vulnerability has a CVSS score of 10.0 (Critical), indicating high impact to confidentiality, integrity, and availability.
Only JupyterHub installations configured to use the LTI13Authenticator class are affected.
Index analysis
The code segment responsible for JWT signature validation was not checking cryptographic signatures before authorizing requests.
An attacker with no privileges or special network position could exploit this remotely without requiring any user interaction.
Governance controls
No workarounds were documented at the time of advisory publication.
The vulnerability was patched in version 1.4.0 of jupyterhub-ltiauthenticator.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.