https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 19:22:41 +0000 https://db.gcve.eu/vuln/cve-2025-61669 <p><strong>Affected:</strong> jupyter-server jupyter_server</p> <p>Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.</p> <p><strong>Affected:</strong> jupyter-server jupyter_server</p> <p>Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.</p> https://db.gcve.eu/vuln/cve-2025-61669 https://db.gcve.eu/vuln/ghsa-qh7q-6qm3-653w <p><strong>Affected:</strong> PyPI: jupyter-server</p> <p>### Summary</p> <p>The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server&lt;=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.</p> <p>### Details</p> <p>The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.</p> <p>- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76</p> <p>This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.</p> <p>### PoC</p> <p>1. Navigate to `http://localhost:8888/login?next=///google.com` 2. Observe that the user is redirected to `google.com` despite it being an external domain.</p> <p>The external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`.</p> <p>### Impact</p> <p>This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.</p> <p>### Patches</p> <p>Jupyter Server 2.18+</p> <p>### Workaround</p> <p>None.</p> <p><strong>Affected:</strong> PyPI: jupyter-server</p> <p>### Summary</p> <p>The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server&lt;=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.</p> <p>### Details</p> <p>The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.</p> <p>- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76</p> <p>This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.</p> <p>### PoC</p> <p>1. Navigate to `http://localhost:8888/login?next=///google.com` 2. Observe that the user is redirected to `google.com` despite it being an external domain.</p> <p>The external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`.</p> <p>### Impact</p> <p>This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.</p> <p>### Patches</p> <p>Jupyter Server 2.18+</p> <p>### Workaround</p> <p>None.</p> https://db.gcve.eu/vuln/ghsa-qh7q-6qm3-653w https://db.gcve.eu/vuln/pysec-2026-67 <p><strong>Affected:</strong> PyPI: jupyter-server</p> <p>Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.</p> <p><strong>Affected:</strong> PyPI: jupyter-server</p> <p>Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.</p> https://db.gcve.eu/vuln/pysec-2026-67