CVE-2025-61669
Medium
Description
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
SeverityMedium
CVSS6.1
Exploit probability—
ProductJupyter Server
PublishedMay 5, 2026
First seenMay 5, 2026
Weakness typeCWE-601Open redirect
How to fix
Update
- jupyter jupyter_server2.18.0 or later
- jupyter-server2.18.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jupyter jupyter_server | v < 2.18.0 | 2.18.0 |
| jupyter-serverPyPI | v < 2.18.0 | 2.18.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.