JupyterHub LTI Authenticator JWT Signature Validation Vulnerability in LTI13Authenticator

A vulnerability exists in the JupyterHub authenticator for learning tools interoperability (LTI), specifically in the 'jupyterhub-ltiauthenticator' package version 1.3.0. The issue arises because the LTI13Authenticator introduced in this version failed to validate JSON Web Token (JWT) signatures. This flaw could allow the authenticator to authorize forged requests, potentially granting access to user identities. The vulnerability affects only those who have configured JupyterHub to use the LTI13Authenticator.

Impact

Exploitation of this vulnerability could lead to unauthorized access by allowing forged requests to be accepted as valid, thereby granting access to user identities.

Remediation

Users can upgrade to 'jupyterhub-ltiauthenticator' version 1.4.0 or later, where this issue has been addressed.