# CVE-2026-40934: Jupyter Server insufficient session expiration after password reset

Source: https://junglewise.ai/threats/cve-2026-40934-jupyter-server-insufficient-session-expiration-after-password  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-05. Updated: 2026-07-25  
License: CC BY 4.0 with a link back

CVE-2026-40934 · Severity: medium · CVSS 6.8 · Published 2026-05-05

Jupyter Server is a backend application used to run interactive web-based notebooks. A security flaw allows previously issued login sessions to remain valid even after a user changes their password or the server is restarted. This means that if an attacker manages to steal a user's session cookie, they can maintain permanent access to the user's data and environment regardless of any security measures taken to reset credentials.

Technologies: [Jupyter Server](https://junglewise.ai/threats/technologies/jupyter-server), [jupyter-server (PyPI)](https://junglewise.ai/threats/technologies/pypi-jupyter-server). Vendors: [Jupyter](https://junglewise.ai/threats/vendors/jupyter), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-40934 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-40934 being exploited in the wild.

**How severe is CVE-2026-40934?** Medium severity, with a CVSS score of 6.8, published 5 May 2026.

**Which products and versions are affected?** Jupyter Server <= 2.17.0; jupyter-server (PyPI) ECOSYSTEM:introduced=0,fixed=2.18.0.

**Is there a fix for CVE-2026-40934?** Yes. jupyter-server (PyPI): upgrade to 2.18.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-40934 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-40934?** Check whether you run Jupyter Server or jupyter-server (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- jupyter-server (PyPI): upgrade to 2.18.0 or later

  ```sh
  pip install "jupyter-server>=2.18.0"
  ```


## Technical details

Jupyter Server (versions 2.17.0 and earlier) persists the secret used to sign authentication cookies in a static file located at ~/.local/share/jupyter/runtime/jupyter_cookie_secret. This secret is not rotated when a user changes their password or when the server restarts. Consequently, any session cookie signed with this static key remains cryptographically valid. An attacker who has obtained a session cookie (via XSS, local access, or other means) can maintain authenticated access to the server indefinitely, bypassing password-based revocation. The issue is classified as CWE-613 (Insufficient Session Expiration) and is fixed in version 2.18.0.

## Affected products

- Jupyter Jupyter Server <= 2.17.0

## Identifiers

- CVE-2026-40934
- GHSA-5mrq-x3x5-8v8f
- PYSEC-2026-69

## Timeline

- 2026-05-05: advisory: GitHub Advisory GHSA-5mrq-x3x5-8v8f published
- 2026-05-05: disclosed
- 2026-05-05: patched: Fixed in version 2.18.0

## References

- [https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f](https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f)

## Related threats

- [Jupyter Server authorization bypass in kernel gateway handlers](https://junglewise.ai/threats/cve-2026-114135-jupyter-server-is-the-backend-for-jupyter-web-applications-from)
- [Jupyter Server token leakage in 5xx error logs](https://junglewise.ai/threats/cve-2026-86049-jupyter-server-token-leakage-in-5xx-error-logs)
- [Jupyter Server stored XSS in nbconvert handlers](https://junglewise.ai/threats/cve-2026-44727-jupyter-server-stored-xss-in-nbconvert-handlers)
- [Jupyter Jupyter Server CORS bypass via improper origin validation](https://junglewise.ai/threats/cve-2026-6657-jupyter-jupyter-server-cors-bypass-via-improper-origin-validation)
- [Jupyter jupyter-server path traversal in _get_os_path](https://junglewise.ai/threats/cve-2026-5422-jupyter-jupyter-server-path-traversal-in-get-os-path)