---
id: CVE-2025-61669
aliases:
  - GHSA-qh7q-6qm3-653w
  - PYSEC-2026-67
title: Jupyter Server has an open redirection vulnerability in `next` query parameter
summary: Jupyter Server has an open redirection vulnerability in `next` query parameter
severity: medium
vendor: jupyter-server
product: jupyter-server
ecosystem: pip
affected:
  - jupyter-server < 2.18.0
patched:
  - jupyter-server 2.18.0
published: '2026-05-05'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:47.272631530Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-qh7q-6qm3-653w'
references:
  - url: >-
      https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-61669'
  - url: 'https://github.com/jupyter-server/jupyter_server'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-67.yaml
tags:
  - osv
  - pip
epss: 0.00265
epssPercentile: 0.18711
ingestedAt: '2026-09-12T03:13:01.721Z'
---

## Overview

### Summary

The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.

### Details

The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.

- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76

This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.

### PoC

1. Navigate to `http://localhost:8888/login?next=///google.com`
2. Observe that the user is redirected to `google.com` despite it being an external domain.

The external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`. 

### Impact

This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.

### Patches

Jupyter Server 2.18+

### Workaround

None.

## Affected packages

- `jupyter-server < 2.18.0`

## Remediation

Upgrade to a patched release:

- `jupyter-server 2.18.0`