https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-09-30T17:05:54.599006+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2025-61669 CVE-2025-61669 — jupyter_server next parameter open redirect can redirect users to external domains 2026-09-30T17:05:54.629725+00:00

Affected: jupyter-server jupyter_server

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

 https://db.gcve.eu/vuln/ghsa-qh7q-6qm3-653w GHSA-qh7q-6qm3-653w — Jupyter Server has an open redirection vulnerability in `next` query parameter 2026-09-30T17:05:54.629808+00:00

Affected: PyPI: jupyter-server

### Summary

The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.

### Details

The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.

- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76

This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.

### PoC

1. Navigate to `http://localhost:8888/login?next=///google.com` 2. Observe that the user is redirected to `google.com` despite it being an external domain.

The external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`.

### Impact

This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.

### Patches

Jupyter Server 2.18+

### Workaround

None.

 https://db.gcve.eu/vuln/pysec-2026-67 PYSEC-2026-67 2026-09-30T17:05:54.629878+00:00

Affected: PyPI: jupyter-server

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.