https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 05:19:18 +0000 https://db.gcve.eu/vuln/ghsa-5mrq-x3x5-8v8f <p><strong>Affected:</strong> PyPI: jupyter-server</p> <p>## Summary</p> <p>A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes.</p> <p>The cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.</p> <p>## PoC</p> <p>- Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server` - Log in with the password and capture the authentication cookie (e.g., just login with a browser). - Change the password to revoke access: `jupyter server password` - Restart the server - Use the old stolen cookie =&gt; remains valid and provides full authenticated access.</p> <p>## Impact</p> <p>- All jupyter-server deployments using password authentication where security incidents may occur - Multi-user systems where one user&#39;s compromised session should be revocable by administrators - Shared or public-facing Jupyter servers where credential rotation is a security requirement - Any deployment where password changes are expected to revoke existing sessions</p> <p>## Patches</p> <p>Jupyter Server 2.18+</p> <p>## Workaround</p> <p>```bash rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret # Then restart the server ```</p> <p><strong>Affected:</strong> PyPI: jupyter-server</p> <p>## Summary</p> <p>A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes.</p> <p>The cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.</p> <p>## PoC</p> <p>- Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server` - Log in with the password and capture the authentication cookie (e.g., just login with a browser). - Change the password to revoke access: `jupyter server password` - Restart the server - Use the old stolen cookie =&gt; remains valid and provides full authenticated access.</p> <p>## Impact</p> <p>- All jupyter-server deployments using password authentication where security incidents may occur - Multi-user systems where one user&#39;s compromised session should be revocable by administrators - Shared or public-facing Jupyter servers where credential rotation is a security requirement - Any deployment where password changes are expected to revoke existing sessions</p> <p>## Patches</p> <p>Jupyter Server 2.18+</p> <p>## Workaround</p> <p>```bash rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret # Then restart the server ```</p> https://db.gcve.eu/vuln/ghsa-5mrq-x3x5-8v8f