Executive brief
JupyterHub, a platform used to manage multi-user Jupyter notebook environments, is vulnerable to an open redirect flaw. Attackers can create deceptive links that appear to lead to a legitimate JupyterHub login page but instead redirect the user to a malicious external website after they log in. This can be used in phishing campaigns to steal user credentials or deliver malware by exploiting the user's trust in the original domain.
Technical details
An open redirect vulnerability (CWE-601) exists in JupyterHub versions prior to 5.4.4. The application fails to properly validate user-supplied redirect URLs, allowing an attacker to bypass internal checks designed to prevent redirection to external domains. An attacker can exploit this by crafting a URL that points to the JupyterHub login endpoint with a malicious destination in the redirect parameter. If a user clicks the link and authenticates, the application will redirect them to the attacker-controlled site. This issue is patched in version 5.4.4; as a workaround, administrators can implement Location header filtering at the reverse proxy level (e.g., Nginx or Apache).
Affected products
- Jupyter JupyterHub < 5.4.4
Timeline
- 2026-03-26: other: Version 5.4.4 tagged on GitHub
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD