Affected: PyPI: jupyter-server

### Summary

The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.

### Details

The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.

- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76

This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.

### PoC

1. Navigate to `http://localhost:8888/login?next=///google.com` 2. Observe that the user is redirected to `google.com` despite it being an external domain.

The external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`.

### Impact

This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.

### Patches

Jupyter Server 2.18+

### Workaround

None.