GitHub Advisoryadvisory · PyPI

GHSA-3vff-hjqv-m7h8 JupyterHub has an Open Redirect Vulnerability

MEDIUM Published 2026-04-03 Modified 2026-04-27 Official page ↗
Aliases
CVE-2026-33709
Ecosystem
PyPI
Packages
jupyterhub
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-04-03

Affected packages

• PyPI jupyterhub: < 5.4.4 → fixed in 5.4.4

Description

Affected Version JupyterHub <= 5.4.3 Impact An open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this. Patches Upgrade to JupyterHub 5.4.4 Workarounds A deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.

Related

Alias · CVE (1)

  • CVE-2026-33709 JupyterHub is software that allows one to create a multi-user server for Jupyter notebooks. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References