← CVE Intelligence

CVE-2025-61669

jupyter_server next parameter open redirect can redirect users to external domains PUBLISHED

Description (CNA)

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

Affected (CNA)

Vendor / productVersions
jupyter-server / jupyter_serveraffected <= 2.17.0

CWE

CWE-601

References

ADP enrichment

CISA-ADP

No English description supplied.