https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-01T01:42:36.059043+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-40934 CVE-2026-40934 — jupyter-server authentication cookies remain valid after password reset due to static cookie secret 2026-10-01T01:42:36.064418+00:00

Affected: jupyter-server jupyter_server

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.

 https://db.gcve.eu/vuln/ghsa-5mrq-x3x5-8v8f GHSA-5mrq-x3x5-8v8f — Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart 2026-10-01T01:42:36.064531+00:00

Affected: PyPI: jupyter-server

## Summary

A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes.

The cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.

## PoC

- Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server` - Log in with the password and capture the authentication cookie (e.g., just login with a browser). - Change the password to revoke access: `jupyter server password` - Restart the server - Use the old stolen cookie => remains valid and provides full authenticated access.

## Impact

- All jupyter-server deployments using password authentication where security incidents may occur - Multi-user systems where one user's compromised session should be revocable by administrators - Shared or public-facing Jupyter servers where credential rotation is a security requirement - Any deployment where password changes are expected to revoke existing sessions

## Patches

Jupyter Server 2.18+

## Workaround

```bash rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret # Then restart the server ```

 https://db.gcve.eu/vuln/pysec-2026-69 PYSEC-2026-69 2026-10-01T01:42:36.064604+00:00

Affected: PyPI: jupyter-server

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.