CVE-2026-40934: jupyter-server authentication cookies remain valid after password reset due to static cookie secret
Summary
A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes.
The cookie secret used to sign authentication cookies is stored in a permanent file (~/.local/share/jupyter/runtime/jupytercookiesecret) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.
PoC
- Start a Jupyter server with password authentication: jupyter server password, jupyter server - Log in with the password and capture the authentication cookie (e.g., just login with a browser). - Change the password to revoke access: jupyter server password - Restart the server - Use the old stolen cookie => remains valid and provides full authenticated access.
Impact
- All jupyter-server deployments using password authentication where security incidents may occur - Multi-user systems where one user's compromised session should be revocable by administrators - Shared or public-facing Jupyter servers where credential rotation is a security requirement - Any deployment where password changes are expected to revoke existing sessions
Patches
Jupyter Server 2.18+
Workaround
bash rm ~/.local/share/jupyter/runtime/jupytercookiesecret Then restart the server
Other sources
Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupytercookiesecret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/jupyter-serverto a version that resolves this vulnerability.Fixed in 2.18.0 - Upgrade
Upgrade
Jupyter Serverto a version that resolves this vulnerability.Fixed in 2.18.0 - Configuration
To revoke previously issued authentication cookies after password changes, remove the persisted cookie secret file: rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret
Jupyter Server jupyter_cookie_secret rotation = rotate/clear cookie secret (remove persisted file) - Operational
Change the password using `jupyter server password`, log in with the new password, and if needed restart the server ("Then restart the server") to ensure previously issued authentication cookies are no longer accepted.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-40934?
CVE-2026-40934 is considered a high-severity vulnerability due to its potential for enabling unauthorized persistent access to the application.
How do I fix CVE-2026-40934?
To fix CVE-2026-40934, upgrade to jupyter-server version 2.18.0 or later immediately.
What causes CVE-2026-40934?
CVE-2026-40934 is caused by the persistent storage of the cookie secret in a file that is not updated upon password changes.
Who is affected by CVE-2026-40934?
Users of jupyter-server versions up to and including 2.17.0 are affected by CVE-2026-40934.
What are the potential consequences of CVE-2026-40934?
The consequences of CVE-2026-40934 include the risk of authenticated users retaining access indefinitely, potentially compromising sensitive data.