CVE-2025-61669 — jupyter_server next parameter open redirect can redirect users to external domains

Affected: jupyter-server jupyter_server

Jupyter Server is the backend for Jupyter web applications. In jupyter_server versions through 2.17.0, the next query parameter in the login flow is insufficiently validated in `LoginFormHandler._redirect_safe()`, which allows redirects to arbitrary external domains via values such as `///example.com`. An attacker can use a crafted login URL to redirect users to a malicious site and facilitate phishing attacks. This issue is fixed in version 2.18.0.

GHSA-24qx-w28j-9m6p — Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`

Affected: PyPI: jupyter-server

Jupyter Server uses `re.match()` to validate the Origin header against the `allow_origin_pat` configuration.

Since `re.match()` only anchors at the start of the string, an attacker who controls a domain like `http://trusted.example.com.evil.com/` passes validation against a pattern intended to match only `trusted.example.com`.

### Impact

<=2.17.0

### Patches

057869a327c46730afede3eab0ca2d2e3e74acea, 49b34392feaa97735b3b777e3baf8f22f2a14ed8

### Workarounds

Wrap your `allow_origin_pat` value with `^` and `$`

### References

https://github.com/jupyter-server/jupyter_server/pull/603 https://docs.python.org/3/library/re.html#re.fullmatch https://docs.python.org/3/library/re.html#re.match

Most recent entries from all

CVE-2025-61669 — jupyter_server next parameter open redirect can redirect users to external domains

GHSA-24qx-w28j-9m6p — Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`