JupyterHub vulnerabilities

JupyterHub before version 5.5.0 has a vulnerability where invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and storage resources.

JupyterHub versions 4.1.0 through 5.4.4 inappropriately treated requests with Sec-Fetch-Mode: no-cors as same-origin requests, bypassing XSRF checks. This affects only HTTP form endpoints, allowing attackers to trigger server spawn and, if the attacker is a JupyterHub user with share permissions, force a user to accept a share and gain access to the attacker's server.

JupyterHub before version 5.4.4 has an open redirect vulnerability that allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site, bypassing JupyterHub's check to prevent this.