{"uuid": "7d3a5e06-a75f-467f-a7f0-9e3a943f5470", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108752", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117422416945640143", "content": "CVE-2026-108752 JupyterHub through 6.0.1 OAuth Client ID Collision via Unescaped Hyphen JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server OAuth client by registering a hyphenated username. Attackers holding a name like alice-prod can overwrite the client for alice's server prod, breaking OAuth login and revoking tokens by stopping their own server.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108752https://hackmd.io/@haind/jupyterhub-oauth-client-id-cross-user-collisionhttps://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L563-L567https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/oauth/provider.py#L719-L754https://github.com/jupyterhub/jupyterhub/blob/3e516c6f382b481e815ec455befb2f14d80d337b/jupyterhub/user.py#L1174-L1186https://github.com/jupyterhub/jupyterhubhttps://www.vulncheck.com/advisories/jupyterhub-through-6.0.1-oauth-client-id-collision-via-unescaped-hyphen#jupyterhub#CVE_2026_108752#bot", "creation_timestamp": "2026-10-11T13:04:51.935078Z"}