Answer in brief
CVE-2025-61669 records a Medium severity (CVSS 6.1) vulnerability in Jupyter Server has an open redirection vulnerability in `next` query parameter. The current sources do not mark it as known exploited. The current feed maps jupyter-server (pip), jupyter-server (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 6.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps jupyter-server (pip), jupyter-server (pypi). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:a:jupyter:jupyter_server:*:*:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| jupyter-serverpip | <=2.17.0 | 2.18.0 |
| jupyter-serverpypi | >=0 <2.18.0 | 2.18.0 |
Published upstream
May 5, 2026
Evidence: source:nvd:source_dates:source-dates:recordSource modified
Oct 7, 2026
Evidence: source:nvd:source_dates:source-dates:recordFirst seen by HOL
Jun 11, 2026
### Summary The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users. ### Details The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method. - Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76 This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them. ### PoC 1. Navigate to `http://localhost:8888/login?next=///google.com` 2. Observe that the user is redirected to `google.com` despite it being an external domain. The external domain passed in the `?next` parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as `prod.company.com` may be redirected to a look-alike URL such as `prod.company.dev`. ### Impact This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data. ### Patches Jupyter Server 2.18+ ### Workaround None.
Quoted source text, attributed separately from HOL analysis.