CVE-2025-61669Medium▾ SunlitJupyter Server has an open redirection vulnerability in `next` query parameter
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
The ?next=... URL query parameter has an open redirection vulnerability. In jupyter_server<=2.17.0, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.
The vulnerability is caused by insufficient validation in the LoginFormHandler._redirect_safe() method.
This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.
http://localhost:8888/login?next=///google.comgoogle.com despite it being an external domain.The external domain passed in the ?next parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as prod.company.com may be redirected to a look-alike URL such as prod.company.dev.
This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.
Jupyter Server 2.18+
None.
jupyter-server < 2.18.0Upgrade to a patched release:
jupyter-server 2.18.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-39968Medium· 6.1Open Redirect Vulnerability in jupyter-server
CVE-2022-29241High· 7.1Jupyter server Token bruteforcing
CVE-2024-35178High· 7.5Jupyter server on Windows discloses Windows user password hash
CVE-2023-49080Medium· 4.3jupyter-server errors include tracebacks with path information
CVE-2020-26232Medium· 4.1Open redirect in Jupyter Server
CVE-2023-40170Medium· 4.6cross-site inclusion (XSSI) of files in jupyter-server