{"id":"CVE-2026-40934","aliases":["GHSA-5mrq-x3x5-8v8f","PYSEC-2026-69"],"url":"https://o3.security/vulnerability/CVE-2026-40934","summary":"jupyter-server authentication cookies remain valid after password reset due to static cookie secret","details":"## Summary\n\nA persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes. \n\nThe cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.\n\n## PoC\n\n- Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server`\n- Log in with the password and capture the authentication cookie (e.g., just login with a browser).\n- Change the password to revoke access: `jupyter server password`\n- Restart the server\n- Use the old stolen cookie => remains valid and provides full authenticated access.\n\n## Impact\n\n- All jupyter-server deployments using password authentication where security incidents may occur\n- Multi-user systems where one user's compromised session should be revocable by administrators\n- Shared or public-facing Jupyter servers where credential rotation is a security requirement\n- Any deployment where password changes are expected to revoke existing sessions\n\n## Patches\n\nJupyter Server 2.18+\n\n## Workaround\n\n```bash\nrm ~/.local/share/jupyter/runtime/jupyter_cookie_secret\n# Then restart the server\n```","published":"2026-05-05T21:31:42.897Z","modified":"2026-09-12T03:46:15.281166605Z","cvss":null,"epss":{"score":0.00308,"percentile":0.23668,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"jupyter-server","fixedVersion":"2.18.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40934.json"},{"type":"ADVISORY","url":"https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-40934"},{"type":"PACKAGE","url":"https://github.com/jupyter-server/jupyter_server"},{"type":"WEB","url":"https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-69.yaml"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-12T03:46:15.281166605Z"}}