CVE-2025-61669
jupyter_server next parameter open redirect can redirect users to external domains
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
| CWE | CWE-601 |
| Vendor | jupyter-server |
| Product | jupyter_server |
| Published | May 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for jupyter-server jupyter_server
Be the first to know when new unknown vulnerabilities affecting jupyter-server jupyter_server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
jupyter-server / jupyter_server
<= 2.17.0