# CVE-2020-26275: Jupyter Server open redirect vulnerability

Source: https://junglewise.ai/threats/cve-2020-26275-jupyter-server-open-redirect-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2020-12-21. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2020-26275 · Severity: medium · CVSS 6.1 · Published 2020-12-21

Jupyter Server is a web application used for interactive computing and data science. A vulnerability exists where a specially crafted link can trick users into being redirected from their trusted Jupyter environment to a malicious website. This could be used in phishing attacks to steal user credentials or deliver malware by mimicking the appearance of the legitimate server.

Technologies: [jupyter-server (PyPI)](https://junglewise.ai/threats/technologies/pypi-jupyter-server). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2020-26275 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-26275 being exploited in the wild.

**How severe is CVE-2020-26275?** Medium severity, with a CVSS score of 6.1, published 21 December 2020.

**Which products and versions are affected?** jupyter-server (PyPI) ECOSYSTEM:introduced=0,fixed=1.1.1, GIT:introduced=0,fixed=85e4abccf6ea9321d29153f73b0bd72ccb3a6bca|ECOSYSTEM:introduced=0,fixed=1.1.1.

**Is there a fix for CVE-2020-26275?** Yes. jupyter-server (PyPI): upgrade to 1.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-26275 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-26275?** Check whether you run jupyter-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jupyter-server (PyPI): upgrade to 1.1.1 or later

  ```sh
  pip install "jupyter-server>=1.1.1"
  ```


## Technical details

An open redirect vulnerability (CWE-601) exists in Jupyter Server versions prior to 1.1.1. The issue occurs when the server is configured without a 'base_url' prefix, allowing an attacker to construct a URL that the server will redirect to an arbitrary external domain. Exploitation requires a user to click a maliciously crafted link. This can facilitate phishing or social engineering attacks by leveraging the trust of the Jupyter Server's domain. The vulnerability was addressed in version 1.1.1; a workaround involves setting a non-root base URL using the '--ServerApp.base_url' configuration.

## Affected products

- Jupyter jupyter-server < 1.1.1

## Identifiers

- CVE-2020-26275
- GHSA-9f66-54xg-pc2c
- PYSEC-2020-346
- PYSEC-2020-50

## Timeline

- 2020-12-16: disclosed
- 2020-12-16: patched: Patched in version 1.1.1
- 2020-12-21: advisory

## References

- [https://api.github.com/users/Yaniv-git](https://api.github.com/users/Yaniv-git)
- [https://github.com/Yaniv-git](https://github.com/Yaniv-git)
- [https://api.github.com/users/Yaniv-git/gists%7B/gist_id%7D](https://api.github.com/users/Yaniv-git/gists%7B/gist_id%7D)
- [https://api.github.com/users/Yaniv-git/repos](https://api.github.com/users/Yaniv-git/repos)
- [https://avatars.githubusercontent.com/u/59412524?v=4](https://avatars.githubusercontent.com/u/59412524?v=4)
- [https://api.github.com/users/Yaniv-git/events%7B/privacy%7D](https://api.github.com/users/Yaniv-git/events%7B/privacy%7D)

## Related threats

- [Jupyter Server authorization bypass in kernel gateway handlers](https://junglewise.ai/threats/cve-2026-114135-jupyter-server-is-the-backend-for-jupyter-web-applications-from)
- [Jupyter Server token leakage in 5xx error logs](https://junglewise.ai/threats/cve-2026-86049-jupyter-server-token-leakage-in-5xx-error-logs)
- [Jupyter Server stored XSS in nbconvert handlers](https://junglewise.ai/threats/cve-2026-44727-jupyter-server-stored-xss-in-nbconvert-handlers)
- [Jupyter Jupyter Server CORS bypass via improper origin validation](https://junglewise.ai/threats/cve-2026-6657-jupyter-jupyter-server-cors-bypass-via-improper-origin-validation)
- [Jupyter jupyter-server path traversal in _get_os_path](https://junglewise.ai/threats/cve-2026-5422-jupyter-jupyter-server-path-traversal-in-get-os-path)