{"id":"CVE-2025-61669","aliases":["GHSA-qh7q-6qm3-653w","PYSEC-2026-67"],"url":"https://o3.security/vulnerability/CVE-2025-61669","summary":"jupyter_server next parameter open redirect can redirect users to external domains","details":"### Summary\n\nThe `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.\n\n### Details\n\nThe vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.\n\n- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76\n\nThis vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.\n\n### PoC\n\n1. Navigate to `http://localhost:8888/login?next=///google.com`\n2. Observe that the user is redirected to `google.com` despite it being an external domain.\n\nThe external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`. \n\n### Impact\n\nThis vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.\n\n### Patches\n\nJupyter Server 2.18+\n\n### Workaround\n\nNone.","published":"2026-05-05T15:28:43.833Z","modified":"2026-10-28T02:30:53.864880898Z","cvss":null,"epss":{"score":0.00265,"percentile":0.18615,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"jupyter-server","fixedVersion":"2.18.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61669.json"},{"type":"ADVISORY","url":"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-61669"},{"type":"PACKAGE","url":"https://github.com/jupyter-server/jupyter_server"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-67.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:53.864880898Z"}}