Every CVE Search/ Get API key

CVE-2023-39968

Open Redirect Vulnerability in jupyter-server

4.3 MediumFix available

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.68%Up 0.6 points since Aug 29, 2023
90%50%10%1%

What each source reports

CVE List Score used 4.3

Open Redirect Vulnerability in jupyter-server

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-39968
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-601
Updated
2026-11-02
EUVDEUVD-2023-0102 4.3

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
EUVD-2023-0102
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-r726-vmfq-j9j3 5.3

Open Redirect Vulnerability in jupyter-server

Impact

Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs.

Patches

Upgrade to Jupyter Server 2.7.2

Workarounds

None.

References

Vulnerability reported by user davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Record
GHSA-r726-vmfq-j9j3
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
NVD 4.3

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-39968
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSVALPINE-CVE-2023-39968 6.1

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
ALPINE-CVE-2023-39968
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-03
OSV 4.3

Open Redirect Vulnerability in jupyter-server

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
CVE-2023-39968
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weakness
CWE-601
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2023-39968 6.1

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
DEBIAN-CVE-2023-39968
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-r726-vmfq-j9j3 5.3

Open Redirect Vulnerability in jupyter-server

Impact

Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs.

Patches

Upgrade to Jupyter Server 2.7.2

Workarounds

None.

References

Vulnerability reported by user davwwwx via the bug bounty program sponsored by the European Commission and hosted on the Intigriti platform.

Record
GHSA-r726-vmfq-j9j3
CVSS 4.0
5.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-601
Updated
2026-11-02
OSVPYSEC-2023-155 6.1

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
PYSEC-2023-155
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2023-39968 4.3

jupyter-server is the backend for Jupyter web applications. Open Redirect Vulnerability. Maliciously crafted login links to known Jupyter Servers can cause successful login or an already logged-in session to be redirected to arbitrary sites, which should be restricted to Jupyter Server-served URLs. This issue has been addressed in commit 29036259 which is included in release 2.7.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Record
UBUNTU-CVE-2023-39968
CVSS 3.1
4.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2024:13260-1 No score

python310-jupyter-server-2.7.3-1.1 on GA media

These are all security issues fixed in the python310-jupyter-server-2.7.3-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13260-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:12012-1 No score

python313-jupyter-server-2.20.0-1.3 on GA media

These are all security issues fixed in the python313-jupyter-server-2.20.0-1.3 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:12012-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
jupyter-server
PyPI
 before 2.7.2
2.7.2
jupyter-server
Alpine:v3.19
 before 2.7.3-r0
2.7.3-r0
jupyter-server
Alpine:v3.20
 before 2.7.3-r0
2.7.3-r0
jupyter-server
Alpine:v3.21
 before 2.7.3-r0
2.7.3-r0
jupyter-server
Alpine:v3.22
 before 2.7.3-r0
2.7.3-r0
jupyter-server
Alpine:v3.23
 before 2.7.3-r0
2.7.3-r0
jupyter-server
Alpine:v3.24
 before 2.7.3-r0
2.7.3-r0
jupyter-server
Debian:12
 All versions, plus listed versions
1.23.3-11.23.3-22.14.0-12.14.2-12.14.2-2
Show 9 moreShow less
2.14.2-32.14.2-42.14.2-52.15.0-12.17.0-12.20.0-12.20.0-22.20.0-32.9.1-1
 None known
jupyter-server
Debian:13
 before 2.14.2-1
2.14.2-1
jupyter-server
Debian:14
 before 2.14.2-1
2.14.2-1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
jupyter-server
PyPI
 before 2.7.2, plus listed versions
0.0.00.0.10.0.20.0.30.0.4
Show 45 moreShow less
0.0.50.1.00.1.10.2.00.2.10.3.01.0.01.0.0rc01.0.0rc11.0.0rc101.0.0rc111.0.0rc121.0.0rc131.0.0rc141.0.0rc151.0.0rc161.0.0rc21.0.0rc31.0.0rc41.0.0rc51.0.0rc61.0.0rc71.0.0rc81.0.0rc91.0.11.0.101.0.111.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.31.1.41.10.01.10.11.10.21.11.01.11.1
2.7.2
jupyter-server
Ubuntu:22.04:LTS
 All versions, plus listed versions
1.2.2-11.13.1-1
 None known
jupyter-server
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.23.3-11.23.3-2
 None known
jupyter-server
Ubuntu:25.10
 All versions, plus listed versions
2.14.2-52.15.0-1
 None known
jupyter-server
Ubuntu:26.10
 All versions, plus listed versions
2.17.0-12.20.0-3
 None known
jupyter-server
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.15.0-12.17.0-1
 None known
python-jupyter-server
openSUSE:Tumbleweed
From an advisory covering 4 CVEs
 before 2.20.0-1.3
2.20.0-1.3

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-39968 is a medium vulnerability (CVSS 4.3) in Jupyter Server, published August 28, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in jupyter-server 2.7.2.

References

Show 12 moreShow less
This page doesn't list everything

Left out here: 82 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open