{"id":"CVE-2026-33709","aliases":["BIT-jupyterhub-2026-33709","GHSA-3vff-hjqv-m7h8","PYSEC-2026-2188"],"url":"https://o3.security/vulnerability/CVE-2026-33709","summary":"JupyterHub has an Open Redirect Vulnerability","details":"## Affected Version\n\nJupyterHub <= 5.4.3\n\n## Impact\n\nAn open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this.\n\n## Patches\n\nUpgrade to JupyterHub 5.4.4\n\n## Workarounds\n\nA deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.","published":"2026-04-03T22:00:46.703Z","modified":"2026-10-28T02:30:35.118485595Z","cvss":null,"epss":{"score":0.00224,"percentile":0.12848,"asOf":"2026-08-24"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"jupyterhub","fixedVersion":"5.4.4"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/jupyterhub/jupyterhub/releases/tag/5.4.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33709.json"},{"type":"ADVISORY","url":"https://github.com/jupyterhub/jupyterhub/security/advisories/GHSA-3vff-hjqv-m7h8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33709"},{"type":"PACKAGE","url":"https://github.com/jupyterhub/jupyterhub"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:35.118485595Z"}}