PT-2026-37055 · Project Jupyter · Jupyter Server

Published 2026-05-05 · Updated 2026-05-11 · CVE-2025-61669

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.18.0

Description Insufficient validation of the next query parameter in the login flow within the LoginFormHandler. redirect safe() function allows redirects to arbitrary external domains. An attacker can use a crafted login URL to redirect users to a malicious site, facilitating phishing attacks. This is particularly risky for deployments served on public domains where users may be redirected to look-alike URLs.

Recommendations Update to version 2.18.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2025-61669

GHSA-QH7Q-6QM3-653W

OPENSUSE-SU-2026:10710-1

PYSEC-2026-67

Affected Products

Jupyter Server

References · 16

• 🔥 https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2026:10710-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-67 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-61669 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-61669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-61669 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-61669 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-61669 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qh7q-6qm3-653w · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-61669 · Security Note
• https://github.com/jupyter-server/jupyter_server · Note
• https://suse.com/security/cve/CVE-2026-40110 · Note
• https://suse.com/security/cve/CVE-2026-40934 · Note
• https://suse.com/security/cve/CVE-2025-61669 · Note
• https://t.me/cveNotify/163028 · Telegram Post