CVE-2025-61669: jupyter_server next parameter open redirect can redirect users to external domains
Summary
The ?next=... URL query parameter has an open redirection vulnerability. In jupyterserver<=2.17.0, this URL query parameter allows redirection to arbitrary external domains, which can be exploited to facilitate phishing attacks on server users.
Details
The vulnerability is caused by insufficient validation in the LoginFormHandler.redirectsafe() method.
- Source code reference: https://github.com/jupyter-server/jupyterserver/blob/987ebdd5e188cdc49751b01a0d6782d686492a53/jupyterserver/auth/login.py#L33-L76
This vulnerability was originally reported by Noriaki Iwasaki. All discovery credit goes to them.
PoC
1. Navigate to http://localhost:8888/login?next=///google.com 2. Observe that the user is redirected to google.com despite it being an external domain.
The external domain passed in the ?next parameter may be replaced with a malicious lookalike to facilitate phishing attacks. Jupyter Server deployments served on a public domain are especially vulnerable, as prod.company.com may be redirected to a look-alike URL such as prod.company.dev.
Impact
This vulnerability affects all users, especially enterprise users who work with sensitive/confidential data.
Patches
Jupyter Server 2.18+
Workaround
None.
Other sources
Jupyter Server is the backend for Jupyter web applications. In jupyterserver versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in LoginFormHandler.redirectsafe(), which allows redirects to arbitrary external domains via values such as ///example.com. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61669?
CVE-2025-61669 is classified as a medium severity vulnerability due to its potential to facilitate open redirection attacks.
How can CVE-2025-61669 be exploited?
CVE-2025-61669 can be exploited by manipulating the `?next=...` URL parameter to redirect users to malicious external domains.
How do I fix CVE-2025-61669?
To fix CVE-2025-61669, upgrade to jupyter_server version 2.18.0 or later.
What versions of jupyter_server are affected by CVE-2025-61669?
CVE-2025-61669 affects jupyter_server versions up to and including 2.17.0.
What is the impact of CVE-2025-61669 on users?
The impact of CVE-2025-61669 on users includes potential phishing and exposure to malicious websites due to unauthorized redirection.