Jupyter: Jupyter Server has an open redirection vulnerability in `next` query parameter
Jupyter
More for Jupyter RSS feed for Jupyter
- Severity
- Medium, CVSS 6.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Record
- CVE-2025-61669
- Affects
- Jupyter
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- May 5, 2026
- Source last modified
- October 7, 2026
Description
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler._redirect_safe(), which allows redirects to arbitrary external domains via values such as ///example.com. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
Description quoted from the NVD record.