JupyterHub versions prior to 5.4.4 contain an open redirect flaw that enables an attacker to craft URLs that, after a user logs in, forward them to an arbitrary external site. By exploiting CWE-601, a malicious actor can deliver phishing content or malicious payloads once the user has authenticated, potentially compromising credentials or other sensitive data. The flaw does not grant direct code execution but can be used to subvert user trust and facilitate further attacks.

The issue affects the JupyterHub application supplied by the community. Any instance running a version older than 5.4.4 is susceptible, as the patch was introduced in that release. No other vendors or product lines are listed as affected.

The vulnerability has a CVSS score of 5.1, indicating moderate potential impact. Exploit likelihood is unquantified (EPSS not available), and the flaw is not listed in CISA’s KEV catalog. An attacker can exploit the flaw by sending a user a carefully constructed link that, once clicked, redirects the authenticated session to a malicious domain. Such an exploit requires user interaction but does not require privileged access on the target system.