CVE-2023-25574 - CVE House
Back to Database
Status published Critical CVE-2023-25574

JupyterHub's LTI13Authenticator: JWT signature not validated

Vulnerability Description

`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduced in `jupyterhub-ltiauthenticator` 1.3.0 wasn't validating JWT signatures. This is believed to allow the LTI13Authenticator to authorize a forged request. Only users that has configured a JupyterHub installation to use the authenticator class `LTI13Authenticator` are affected. `jupyterhub-ltiauthenticator` version 1.4.0 removes LTI13Authenticator to address the issue. No known workarounds are available.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-25574

Credits & Attribution

No credits recorded in the NVD database.

References

More from jupyterhub

View All →
CVE-2025-32428
Jupyter Remote Desktop Proxy makes TigerVNC accessible via the network and not just via a UNIX socket as intended
Critical 9
CVE-2024-41942
JupyterHub has a privilege escalation vulnerability with the `admin:users` scope
High 7.2
CVE-2024-37300
Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0
High 8.1
CVE-2024-35225
Jupyter Server Proxy has a reflected XSS issue in host parameter
Critical 9.7
CVE-2024-29033
GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspace
High 7.5

Affected Vendor

Affected Software

ltiauthenticator
Vulnerable Versions:
= 1.3.0

Timeline

Official Publish: February 25th, 2025
Last Modified: February 25th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses (CWE)

CWE-347

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls
Defense Evasion
T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1565 Data Manipulation
Impact