Description

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

INFO

Published Date :

2026-05-05T15:28:43.833Z

Last Modified :

2026-05-05T20:16:59.332Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2025-61669 vulnerability.

Vendors Products
Jupyter
  • Jupyter Server
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2025-61669.

URL Resource
https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-qh7q-6qm3-653w cve-icon cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Attack Requirements
Privileges Required
User Interaction
VS Confidentiality
VS Integrity
VS Availability
SS Confidentiality
SS Integrity
SS Availability