Jupyter Lti Jupyterhub Authenticator vulnerabilities

2 CVEs affecting Jupyter Lti Jupyterhub Authenticator, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-34052, published 2026-04-03.

More from Jupyter.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-34052, published 2026-04-03. Medium severity, CVSS 5.9. EPSS: 0.4% chance of exploitation in the next 30 days. LTI JupyterHub Authenticator is a JupyterHub authenticator for LTI. Prior to version 1.6.3, the LTI 1.1 validator stores OAuth nonces in a class-level dictionary that grows without bounds. Nonces are…
• CVE-2023-25574, published 2025-02-25. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating…