Jupyter Server’s login flow accepts a next query parameter that is not properly validated; values such as "///example.com" send users to arbitrary external domains. This flaw, identified as CWE‑601, enables attackers to craft login URLs that redirect unsuspecting users to malicious sites, facilitating phishing attacks and potentially credential compromise. The vulnerability does not grant direct code execution or system access, but it undermines trust and can lead to phishing success by redirecting users to attacker‑controlled domains.

The issue is present in all jupyter_server versions up to and including 2.17.0. The affected product is the jupyter_server component provided by the jupyter-server organization. The vulnerability was fixed in version 2.18.0, so any installation using an older version requires updating.

The CVSS score of 6.3 indicates a medium severity impact, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, suggesting it has not yet been widely exploited in the wild. Attackers can exploit this flaw remotely by directing users to a malicious URL through a crafted login link; no special privileges or system access are required. Given the ease of use, phishing campaigns could leverage this redirect to lure users into phishing sites, although the exploit does not directly steal data or enable arbitrary code execution.