JupyterHub through 6.0.1 contains an identifier collision vulnerability that allows authenticated users to overwrite another user's named-server… (CVE-2026-108752)

JupyterHub through version 6.0.1 contains an identifier collision vulnerability (CVE-2026-108752) where an authenticated user can register a hyphenated username (e.g., alice-prod) that collides with another user's named-server OAuth client identifier (e.g., alice's server named 'prod'). This collision allows the attacker to overwrite the OAuth client configuration for the victim's server, causing disruption of OAuth login and revocation of tokens by stopping the attacker's own server.

The vulnerability can lead to denial of service on OAuth login for the affected user's named server and revocation of their OAuth tokens, impacting availability and integrity of the OAuth authentication process. There is no direct confidentiality impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, consider restricting user registration policies or monitoring for suspicious hyphenated usernames to mitigate risk.