jupyter-server jupyter_server up to 2.17.x Password Change jupyter_cookie_secret session expiration

Summaryinfo

A vulnerability was found in jupyter-server jupyter_server up to 2.17.x. It has been rated as critical. Affected by this issue is some unknown functionality of the file ~/.local/share/jupyter/runtime/jupyter_cookie_secret of the component Password Change Handler. Performing a manipulation results in session expiration. This vulnerability was named CVE-2026-40934. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, was found in jupyter-server jupyter_server up to 2.17.x. This affects an unknown function of the file ~/.local/share/jupyter/runtime/jupyter_cookie_secret of the component Password Change Handler. The manipulation with an unknown input leads to a session expiration vulnerability. CWE is classifying the issue as CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2026-40934 since 04/15/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.18.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-27513). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• jupyter-server

Name

• jupyter_server

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5
• 2.6
• 2.7
• 2.8
• 2.9
• 2.10
• 2.11
• 2.12
• 2.13
• 2.14
• 2.15
• 2.16
• 2.17

Website

• Product: https://github.com/jupyter-server/jupyter_server/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion