CVE-2025-61669
published 2026-05-05CVE-2025-61669: Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.24%
14.8th percentile
Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jupyter-server | >= 0 < 2.18.0 | 2.18.0 |
| jupyter-server | jupyter_server | <= 2.17.0 | — |
| jupyter | jupyter_server | < 2.18.0 | 2.18.0 |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-datascience-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cpu-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-minimal-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-pytorch-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 | — | — |
| rhoai | odh-workbench-jupyter-trustyai-cpu-py312-rhel9 | — | — |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
jupyter-server jupyter_server up to 2.17.0 Login LoginFormHandler._redirect_safe Next (GHSA-qh7q-6qm3-653w / EUVD-2025-209644)
vuldb·2026-05-05·CVSS 6.3
CVE-2025-61669 [MEDIUM] jupyter-server jupyter_server up to 2.17.0 Login LoginFormHandler._redirect_safe Next (GHSA-qh7q-6qm3-653w / EUVD-2025-209644)
A vulnerability categorized as problematic has been discovered in jupyter-server jupyter_server up to 2.17.0. This impacts the function LoginFormHandler._redirect_safe of the component Login Handler. The manipulation of the argument Next results in open redirect.
This vulnerability is cataloged as CVE-2025-61669. The attack may be launched remotely. There is no exploit available.
It is advisable to upgrade the affected component.
GHSA
Jupyter Server has an open redirection vulnerability in `next` query parameter
ghsa·2026-05-05
CVE-2025-61669 [MEDIUM] CWE-601 Jupyter Server has an open redirection vulnerability in `next` query parameter
Jupyter Server has an open redirection vulnerability in `next` query parameter
### Summary
The `?next=...` URL query parameter has an open redirection vulnerability. In `jupyter_server<=2.17.0`, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.
### Details
The vulnerability is caused by insufficient validation in the `LoginFormHandler._redirect_safe()` method.
- Source code reference: https://github.com/jupyter-server/jupyter_server/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyter_server/auth/login.py#L33-L76
This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.
### PoC
1. Navigate to `http://localhost:8888/login?next=///google.com`
2. Obs
Red Hat
jupyter_server: Jupyter Server: Redirects to arbitrary external domains via insufficient validation of login parameter
vendor_redhat·2026-05-05·CVSS 6.3
CVE-2025-61669 [MEDIUM] CWE-601 jupyter_server: Jupyter Server: Redirects to arbitrary external domains via insufficient validation of login parameter
jupyter_server: Jupyter Server: Redirects to arbitrary external domains via insufficient validation of login parameter
A flaw was found in Jupyter Server. The login flow's `next` query parameter is insufficiently validated, allowing redirects to arbitrary external domains. A remote attacker can exploit this vulnerability by crafting a malicious login URL, which could redirect users to a harmful website and facilitate phishing attacks.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Package: mta/mta-solution-server-rhel9 (Migration Toolkit for Applications 8) - Fix deferred
Package: rhoai/od
No detection rules found.
No public exploits indexed.
2026-05-05
Published