Vulnerability-Lookup

CVE-2025-61669 (GCVE-0-2025-61669)

Vulnerability from cvelistv5 – Published: 2026-05-05 15:28 – Updated: 2026-05-05 20:16

Title

jupyter_server next parameter open redirect can redirect users to external domains

Summary

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

Severity

6.3 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-05 20:16 UTC

CWE

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Assigner

GitHub_M mitre root

References

1 reference

URL	Tags
https://github.com/jupyter-server/jupyter_server/…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
jupyter-server	jupyter_server	Affected: <= 2.17.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-61669",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-05T20:16:38.460105Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-05T20:16:59.332Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "jupyter_server",
          "vendor": "jupyter-server",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.17.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-05T15:28:43.833Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"
        }
      ],
      "source": {
        "advisory": "GHSA-qh7q-6qm3-653w",
        "discovery": "UNKNOWN"
      },
      "title": "jupyter_server next parameter open redirect can redirect users to external domains"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-61669",
    "datePublished": "2026-05-05T15:28:43.833Z",
    "dateReserved": "2025-09-29T20:25:16.180Z",
    "dateUpdated": "2026-05-05T20:16:59.332Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-61669",
      "date": "2026-09-14",
      "epss": "0.00265",
      "percentile": "0.18437"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-61669\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-05T16:16:10.133\",\"lastModified\":\"2026-06-17T09:50:45.103\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"jupyter-server\",\"product\":\"jupyter_server\",\"versions\":[{\"version\":\"\u003c= 2.17.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-05T20:16:38.460105Z\",\"id\":\"CVE-2025-61669\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-601\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"2.18.0\",\"matchCriteriaId\":\"E0B6C703-7E28-4F23-9878-E157975C32A4\"}]}]}],\"references\":[{\"url\":\"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Vendor Advisory\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:06:53+00:00",
      "cve": "CVE-2025-61669",
      "id": "CVE-2025-61669",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_affected": "11",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "jupyter_server: Jupyter Server: Redirects to arbitrary external domains via insufficient validation of login parameter",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61669.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-05-13T14:27:47Z",
      "cve": "CVE-2025-61669",
      "id": "CVE-2025-61669",
      "initial_release_date": "2026-05-07T02:25:00Z",
      "product_status:recommended": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-61669",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-61669.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-61669\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-05T20:16:38.460105Z\"}}}], \"references\": [{\"url\": \"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-05T20:16:10.899Z\"}}], \"cna\": {\"title\": \"jupyter_server next parameter open redirect can redirect users to external domains\", \"source\": {\"advisory\": \"GHSA-qh7q-6qm3-653w\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"jupyter-server\", \"product\": \"jupyter_server\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003c= 2.17.0\"}]}], \"references\": [{\"url\": \"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w\", \"name\": \"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-601\", \"description\": \"CWE-601: URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-05T15:28:43.833Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-61669\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-05-05T20:16:59.332Z\", \"dateReserved\": \"2025-09-29T20:25:16.180Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-05T15:28:43.833Z\", \"assignerShortName\": \"GitHub_M\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

cleanstart-2026-gg76429

Vulnerability from cleanstart

Published

2026-07-30 07:10

Modified

2026-09-04 12:17

Summary

Security fixes in tensorflow-gpu-jupyter 2.21.0-r5

Details

Package tensorflow-gpu-jupyter version 2.21.0-r5 fixes 28 vulnerabilities: ghsa-rch3-82jr-f9w9, ghsa-mqcg-5x36-vfcg, ghsa-37w4-hwhx-4rc4, ghsa-mf9v-mfxr-j63j, ghsa-5mrq-x3x5-8v8f...

References

URL

Type

https://tensorflow.org

WEB

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "CleanStart",
        "name": "tensorflow-gpu-jupyter"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.21.0-r5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.21.0-r5"
      ]
    }
  ],
  "credits": [],
  "database_specific": {},
  "details": "Package tensorflow-gpu-jupyter version 2.21.0-r5 fixes 28 vulnerabilities: ghsa-rch3-82jr-f9w9, ghsa-mqcg-5x36-vfcg, ghsa-37w4-hwhx-4rc4, ghsa-mf9v-mfxr-j63j, ghsa-5mrq-x3x5-8v8f...",
  "id": "CLEANSTART-2026-GG76429",
  "modified": "2026-09-04T12:17:57Z",
  "published": "2026-07-30T07:10:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://tensorflow.org"
    }
  ],
  "related": [],
  "schema_version": "1.7.3",
  "summary": "Security fixes in tensorflow-gpu-jupyter 2.21.0-r5",
  "upstream": [
    "ghsa-rch3-82jr-f9w9",
    "ghsa-mqcg-5x36-vfcg",
    "ghsa-37w4-hwhx-4rc4",
    "ghsa-mf9v-mfxr-j63j",
    "ghsa-5mrq-x3x5-8v8f",
    "ghsa-5789-5fc7-67v3",
    "ghsa-qccp-gfcp-xxvc",
    "ghsa-24qx-w28j-9m6p",
    "ghsa-8mp2-v27r-99xp",
    "ghsa-qh7q-6qm3-653w",
    "ghsa-65pc-fj4g-8rjx",
    "ghsa-6269-cqxg-mhhv",
    "ghsa-ccfx-mfmx-2fx9",
    "ghsa-v87v-83h2-53w7",
    "CVE-2026-45409",
    "CVE-2026-35397",
    "CVE-2026-40110",
    "CVE-2026-40934",
    "CVE-2025-61669",
    "CVE-2026-40171",
    "CVE-2026-42266",
    "CVE-2026-42557",
    "CVE-2026-33079",
    "CVE-2026-44897",
    "CVE-2026-44898",
    "CVE-2026-44899",
    "CVE-2026-44431",
    "CVE-2026-44432"
  ]
}

FKIE_CVE-2025-61669

Vulnerability from fkie_nvd - Published: 2026-05-05 16:16 - Updated: 2026-06-17 09:50

Severity

6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	jupyter	jupyter_server	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "jupyter_server",
          "vendor": "jupyter-server",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= 2.17.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0B6C703-7E28-4F23-9878-E157975C32A4",
              "versionEndExcluding": "2.18.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0."
    }
  ],
  "id": "CVE-2025-61669",
  "lastModified": "2026-06-17T09:50:45.103",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-61669",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-05T20:16:38.460105Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-05T16:16:10.133",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-QH7Q-6QM3-653W

Vulnerability from github – Published: 2026-05-05 16:32 – Updated: 2026-06-05 17:55

Summary

Jupyter Server has an open redirection vulnerability in `next` query parameter

Details

Summary

The ?next=... URL query parameter has an open redirection vulnerability. In jupyter_server<=2.17.0, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.

Details

The vulnerability is caused by insufficient validation in the LoginFormHandler._redirect_safe() method.

Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76

This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.

PoC

Navigate to http://localhost:8888/login?next=///google.com
Observe that the user is redirected to google.com despite it being an external domain.

The external domain passed in the ?next parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as prod.company.com may be redirected to a look-alike URL such as prod.company.dev.

Impact

This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.

Patches

Jupyter Server 2.18+

Workaround

None.

Severity

6.0 (Medium)


                  
                    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.17.0"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyter-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.18.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-61669"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-05T16:32:48Z",
    "nvd_published_at": "2026-05-05T16:16:10Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nThe `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server\u003c=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.\n\n### Details\n\nThe vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.\n\n- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76\n\nThis vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.\n\n### PoC\n\n1. Navigate to `http://localhost:8888/login?next=///google.com`\n2. Observe that the user is redirected to `google.com` despite it being an external domain.\n\nThe external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`. \n\n### Impact\n\nThis vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.\n\n### Patches\n\nJupyter Server 2.18+\n\n### Workaround\n\nNone.",
  "id": "GHSA-qh7q-6qm3-653w",
  "modified": "2026-06-05T17:55:47Z",
  "published": "2026-05-05T16:32:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61669"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jupyter-server/jupyter_server"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-67.yaml"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Jupyter Server has an open redirection vulnerability in `next` query parameter"
}

JVNDB-2026-000080

Vulnerability from jvndb - Published: 2026-05-28 04:42 - Updated:2026-05-28 04:42

Severity

7.4 (High) - cvssV3_0 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Summary

Jupyter Server vulnerable to open redirect

Details

Jupyter Server provided by Jupyter Development Team contains the vulnerability listed below.

Open redirect (CWE-601) - CVE-2025-61669

Noriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA and the developer. JPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.

References

Type

URL

	JVN	https://jvn.jp/en/jp/JVN01719116/index.html
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-61669
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

Vendor

Product

Jupyter Development Team

Jupyter Server

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000080.html",
  "dc:date": "2026-05-28T13:42+09:00",
  "dcterms:issued": "2026-05-28T13:42+09:00",
  "dcterms:modified": "2026-05-28T13:42+09:00",
  "description": "Jupyter Server provided by Jupyter Development Team contains the vulnerability listed below.\u003ca href=\u0027https://cwe.mitre.org/data/definitions/601.html\u0027 target=\u0027_blank\u0027\u003e\u003c/a\u003e\u003cul\u003e\u003cli\u003eOpen redirect (CWE-601) - CVE-2025-61669\u003c/li\u003e\u003c/ul\u003eNoriaki Iwasaki of Cyber Defense Institute, Inc. reported this vulnerability to IPA and the developer.\r\nJPCERT/CC coordinated with the developer to publish the advisory under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2026/JVNDB-2026-000080.html",
  "sec:cpe": {
    "#text": "cpe:/a:misc:jupyter_development_team_jupyter_server",
    "@product": "Jupyter Server",
    "@vendor": "Jupyter Development Team",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.4",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2026-000080",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN01719116/index.html",
      "@id": "JVN#01719116",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-61669",
      "@id": "CVE-2025-61669",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "Jupyter Server vulnerable to open redirect"
}

OPENSUSE-SU-2026:10710-1

Vulnerability from csaf_opensuse - Published: 2026-05-06 00:00 - Updated: 2026-05-06 00:00

Summary

python311-jupyter-server-2.18.1-1.1 on GA media

Severity

Moderate

Scope

4 vulnerabilities in this advisory, including CVE-2025-61669.

CVE-2025-61669

Recommended: 24 products

Open the full advisory

PYSEC-2026-67

Vulnerability from pysec - Published: 2026-05-05 16:16 - Updated: 2026-05-20 09:19

Details

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler._redirect_safe(), which allows redirects to arbitrary external domains via values such as ///example.com. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Impacted products

Name	purl
jupyter-server	pkg:pypi/jupyter-server

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "jupyter-server",
        "purl": "pkg:pypi/jupyter-server"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.18.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.0.0",
        "0.0.1",
        "0.0.2",
        "0.0.3",
        "0.0.4",
        "0.0.5",
        "0.1.0",
        "0.1.1",
        "0.2.0",
        "0.2.1",
        "0.3.0",
        "1.0.0",
        "1.0.0rc0",
        "1.0.0rc1",
        "1.0.0rc10",
        "1.0.0rc11",
        "1.0.0rc12",
        "1.0.0rc13",
        "1.0.0rc14",
        "1.0.0rc15",
        "1.0.0rc16",
        "1.0.0rc2",
        "1.0.0rc3",
        "1.0.0rc4",
        "1.0.0rc5",
        "1.0.0rc6",
        "1.0.0rc7",
        "1.0.0rc8",
        "1.0.0rc9",
        "1.0.1",
        "1.0.10",
        "1.0.11",
        "1.0.2",
        "1.0.3",
        "1.0.4",
        "1.0.5",
        "1.0.6",
        "1.0.7",
        "1.0.8",
        "1.0.9",
        "1.1.0",
        "1.1.1",
        "1.1.2",
        "1.1.3",
        "1.1.4",
        "1.10.0",
        "1.10.1",
        "1.10.2",
        "1.11.0",
        "1.11.1",
        "1.11.2",
        "1.12.0",
        "1.12.1",
        "1.13.0",
        "1.13.1",
        "1.13.2",
        "1.13.3",
        "1.13.4",
        "1.13.5",
        "1.15.0",
        "1.15.1",
        "1.15.2",
        "1.15.3",
        "1.15.4",
        "1.15.5",
        "1.15.6",
        "1.16.0",
        "1.17.0",
        "1.17.1",
        "1.18.0",
        "1.18.1",
        "1.19.0",
        "1.19.1",
        "1.2.0",
        "1.2.1",
        "1.2.2",
        "1.2.3",
        "1.21.0",
        "1.23.0",
        "1.23.1",
        "1.23.2",
        "1.23.3",
        "1.23.4",
        "1.23.5",
        "1.23.6",
        "1.24.0",
        "1.3.0",
        "1.4.0",
        "1.4.1",
        "1.5.0",
        "1.5.1",
        "1.6.0",
        "1.6.1",
        "1.6.2",
        "1.6.3",
        "1.6.4",
        "1.7.0",
        "1.7.0a1",
        "1.7.0a2",
        "1.8.0",
        "1.9.0",
        "2.0.0",
        "2.0.0a0",
        "2.0.0a1",
        "2.0.0a2",
        "2.0.0b0",
        "2.0.0b1",
        "2.0.0rc0",
        "2.0.0rc1",
        "2.0.0rc2",
        "2.0.0rc3",
        "2.0.0rc4",
        "2.0.0rc5",
        "2.0.0rc6",
        "2.0.0rc7",
        "2.0.0rc8",
        "2.0.1",
        "2.0.2",
        "2.0.3",
        "2.0.4",
        "2.0.5",
        "2.0.6",
        "2.0.7",
        "2.1.0",
        "2.10.0",
        "2.10.1",
        "2.11.0",
        "2.11.1",
        "2.11.2",
        "2.12.0",
        "2.12.1",
        "2.12.2",
        "2.12.3",
        "2.12.4",
        "2.12.5",
        "2.13.0",
        "2.14.0",
        "2.14.1",
        "2.14.2",
        "2.15.0",
        "2.16.0",
        "2.17.0",
        "2.2.0",
        "2.2.1",
        "2.3.0",
        "2.4.0",
        "2.5.0",
        "2.6.0",
        "2.7.0",
        "2.7.1",
        "2.7.2",
        "2.7.3",
        "2.8.0",
        "2.9.0",
        "2.9.1"
      ]
    }
  ],
  "aliases": [
    "CVE-2025-61669",
    "GHSA-qh7q-6qm3-653w"
  ],
  "details": "Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.",
  "id": "PYSEC-2026-67",
  "modified": "2026-05-20T09:19:02.865171Z",
  "published": "2026-05-05T16:16:10.133Z",
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

ubuntu-cve-2025-61669

Vulnerability from osv_ubuntu

Published

2026-05-05 16:16

Modified

2026-05-20 15:22

Summary

Details

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler._redirect_safe(), which allows redirects to arbitrary external domains via values such as ///example.com. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

Severity

6.3 (Medium)


                    
                      CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

6.1 (Medium)


                    
                      CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2025-61669	REPORT
	https://www.cve.org/CVERecord?id=CVE-2025-61669	REPORT
	https://github.com/jupyter-server/jupyter_server/…	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "1.13.1-1"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "1.13.1-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@1.13.1-1?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.2.2-1",
        "1.13.1-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "1.23.3-2"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "1.23.3-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@1.23.3-2?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.23.3-1",
        "1.23.3-2"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "2.15.0-1"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "2.15.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:25.10",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@2.15.0-1?arch=source\u0026distro=questing"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.14.2-5",
        "2.15.0-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "jupyter-server",
            "binary_version": "2.17.0-1"
          },
          {
            "binary_name": "python3-jupyter-server",
            "binary_version": "2.17.0-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "jupyter-server",
        "purl": "pkg:deb/ubuntu/jupyter-server@2.17.0-1?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.15.0-1",
        "2.17.0-1"
      ]
    }
  ],
  "aliases": [],
  "details": "Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.",
  "id": "UBUNTU-CVE-2025-61669",
  "modified": "2026-05-20T15:22:57Z",
  "published": "2026-05-05T16:16:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2025-61669"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-61669"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2025-61669"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2025-61669 (GCVE-0-2025-61669)

cleanstart-2026-gg76429

Vulnerability from cleanstart

FKIE_CVE-2025-61669

GHSA-QH7Q-6QM3-653W

Summary

Details

PoC

Impact

Patches

Workaround

JVNDB-2026-000080

OPENSUSE-SU-2026:10710-1

PYSEC-2026-67

ubuntu-cve-2025-61669

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature