CVE-2025-61669

Name of the Vulnerable Software and Affected Versions Jupyter Server versions prior to 2.18.0

Description Insufficient validation of the next query parameter in the login flow within the LoginFormHandler. redirect safe() function allows redirects to arbitrary external domains. An attacker can use a crafted login URL to redirect users to a malicious site, facilitating phishing attacks. This is particularly risky for deployments served on public domains where users may be redirected to look-alike URLs.

Recommendations Update to version 2.18.0 or later.