The vulnerability arises when an attacker possesses an unverified email address on an Auth0 tenant. Because OAuthAuthenticator accepts the email as the username claim before verification, the attacker can supply that address and authenticate to JupyterHub without proving ownership. This bypass allows the attacker to acquire a JupyterHub account, configure it as desired, and potentially impersonate a legitimate user, thereby achieving account takeover.

The issue affects the JupyterHub OAuthenticator plugin, specifically all releases prior to version 17.4.0. Any deployment that integrates Auth0 as an OAuth provider and uses the email claim for username identification is susceptible. Updating to the patched release eliminates the vulnerability.

With a CVSS score of 8.8, the vulnerability is categorized as high risk. Although an EPSS score is not available, the nature of the bypass makes exploitation straightforward for attackers who have control over an Auth0 tenant. The vulnerability is not yet listed in the CISA KEV catalog. Due to the direct authentication pathway, an attacker can potentially gain full control of a JupyterHub instance with minimal effort, reinforcing the need for immediate remediation.