What is CVE-2023-25574?

CVE-2023-25574 is a critical-severity vulnerability in Jupyter Lti Jupyterhub Authenticator, classified under Improper Verification of Cryptographic Signature. CVSS score: 10.0/10. Published 2025-02-25.

How severe is CVE-2023-25574?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Vulnerability in Jupyter Lti Jupyterhub Authenticator

CVE-2023-25574

`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator` version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.

EPSS: 0.003 (27.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Jupyter Lti_jupyterhub_authenticator — versions 1.3.0
Jupyterhub Ltiauthenticator — versions = 1.3.0

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Product, x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2023-25574?: CVE-2023-25574 is a critical-severity vulnerability in Jupyter Lti Jupyterhub Authenticator, classified under Improper Verification of Cryptographic Signature. CVSS score: 10.0/10. Published 2025-02-25.
How severe is CVE-2023-25574?: Critical severity. CVSS v3 base score is 10.0 out of 10.