JupyterHub: hyphenated username collides with another user's named-server OAuth client

Impact

JupyterHub through 6.0.1 derives the OAuth client id for a named server by joining the username and the server name with a hyphen, so a user registered as alice-prod produces the same client id as user alice's named server prod. The colliding user can overwrite that client record, and stopping their own server revokes the victim's tokens and breaks OAuth login to the victim's notebook. On a shared GPU cluster JupyterHub is usually the front door to interactive accelerator sessions, so this is a cross-user denial of service against someone else's running GPU workload - the victim loses access to a session that may hold hours of state on a reserved device. It is integrity and availability only: no access to the victim's notebook contents or data follows from the collision. Exposure depends on whether named servers are enabled and whether the identity source can produce usernames containing hyphens that alias other accounts.

Who can reach it

Network, authenticated as any ordinary Hub user whose username happens to collide (or who can self-register a chosen username). No admin rights needed.

What to do

Upgrade to a JupyterHub release past 6.0.1 that disambiguates the client id. Where upgrading has to wait, constrain the usernames the authenticator will accept so a username cannot alias another user's name plus a server name, or disable named servers. The upgrade is a Hub restart: running single-user notebook servers survive a Hub restart in the usual configurations, but plan the window with users since login is interrupted. No node drain or reboot.

References

Related entries

• iFlytek Astron Agent: workflow resume endpoint accepts another application's event_idCVE-2026-108864 · iFlytek Astron Agent (POST /workflow/v1/resume)Low
• vLLM: unvalidated bad_words token indices corrupt logits of other in-flight requestsCVE-2026-93989 · vLLM sampling parameters (bad_words token index validation)Low
• Langflow: authenticated user reaches eval() through component input options and runs code on the hostCVE-2026-101861 · Langflow schema.py (eval() on component input option values)Low
• vLLM: out-of-bounds read in Mamba2 mixer reachable from a completions requestCVE-2026-105775 · vLLM (Mamba2 mixer conv_ssm_forward, completions request handler)Low
• vLLM: engine crash via the penalty handler when prompt embeds are combined with penaltiesCVE-2026-105922 · vLLM (penalty handler, get_token_bin_counts_and_mask in model_executor/layers/utils.py)Low
• sherpa-onnx: unvalidated vocab_size in model metadata overflows a buffer in the transducer greedy decoderCVE-2026-108954 · sherpa-onnx OfflineTransducerGreedySearchDecoder (model-supplied vocab_size)Low