affected:
- ecosystem_specific: {}
  package:
    ecosystem: PyPI
    name: jupyterhub-ltiauthenticator
    purl: pkg:pypi/jupyterhub-ltiauthenticator
  ranges:
  - events:
    - introduced: '0'
    - last_affected: 1.3.0
    type: ECOSYSTEM
  versions:
  - '0.1'
  - '0.2'
  - '0.3'
  - 0.4.0
  - 1.0.0
  - 1.1.0
  - 1.2.0
  - 1.3.0
aliases:
- CVE-2023-25574
- GHSA-mcgx-2gcr-p3hp
details: '`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning
  tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator`
  1.3.0 wasn''t validating JWT signatures. This is believed to allow the LTI13Authenticator
  to authorize a forged request. Only users that has configured a JupyterHub installation
  to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator`
  version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds
  are available.'
id: PYSEC-2025-120
modified: '2026-05-21T14:54:30.929594Z'
published: '2025-02-25T15:15:16.227Z'
references:
- type: WEB
  url: https://github.com/jupyterhub/ltiauthenticator/blob/3feec2e81b9d3b0ad6b58ab4226af640833039f3/ltiauthenticator/lti13/validator.py#L122-L164
- type: ADVISORY
  url: https://github.com/jupyterhub/ltiauthenticator/blob/main/CHANGELOG.md#140---2023-03-01
- type: ADVISORY
  url: https://github.com/jupyterhub/ltiauthenticator/security/advisories/GHSA-mcgx-2gcr-p3hp
severity:
- score: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  type: CVSS_V3