{"id":"CVE-2025-61669","aliases":["GHSA-qh7q-6qm3-653w","PYSEC-2026-67"],"title":"Jupyter Server has an open redirection vulnerability in `next` query parameter","summary":"Jupyter Server has an open redirection vulnerability in `next` query parameter","severity":"medium","vendor":"jupyter-server","product":"jupyter-server","ecosystem":"pip","affected":["jupyter-server < 2.18.0"],"patched":["jupyter-server 2.18.0"],"published":"2026-05-05","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:47.272631530Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qh7q-6qm3-653w","references":[{"url":"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61669"},{"url":"https://github.com/jupyter-server/jupyter_server"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-67.yaml"}],"tags":["osv","pip"],"epss":0.00265,"epssPercentile":0.18705,"ingestedAt":"2026-09-12T03:13:01.721Z","slug":"CVE-2025-61669","body":"## Overview\n\n### Summary\n\nThe `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.\n\n### Details\n\nThe vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.\n\n- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76\n\nThis vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.\n\n### PoC\n\n1. Navigate to `http://localhost:8888/login?next=///google.com`\n2. Observe that the user is redirected to `google.com` despite it being an external domain.\n\nThe external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`. \n\n### Impact\n\nThis vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.\n\n### Patches\n\nJupyter Server 2.18+\n\n### Workaround\n\nNone.\n\n## Affected packages\n\n- `jupyter-server < 2.18.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jupyter-server 2.18.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}