CVE-2025-61669Medium· 6.1▾ SunlitJupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33.6 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
— → 6.1
Last analysed / modified upstream
0.3% → 0.4%
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler._redirect_safe(), which allows redirects to arbitrary external domains via values such as ///example.com. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
jupyter_server < 2.18.0Upgrade past the affected range:
jupyter_server 2.18.0Affected packages:
jupyter-server < 2.18.0Patched in:
jupyter-server 2.18.0Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114135High· 8.8Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization
CVE-2026-86049High· 7.1Jupyter Server is the backend for Jupyter web applications
CVE-2026-35397High· 8.8Jupyter Server is the backend for Jupyter web applications
CVE-2026-42266High· 8.8JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture
CVE-2026-6657High· 8.8A vulnerability in jupyter-server versions 1.12.0 through 2.17.0 allows an attacker to bypass CORS origin validation when the `allow_origin_pat` configuration is used
CVE-2026-114614Low· 2.6Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback…