Session Cookie Vulnerability in Jupyter Server Affects User Authentication

CVE-2026-40934

What is CVE-2026-40934?

Jupyter Server, the backbone of Jupyter web applications, contains a vulnerability where the secret used to sign authentication cookies is stored in a static file without rotation upon password changes. This design flaw enables an attacker who has intercepted a session cookie to retain authenticated access to the server, even after a user has reset their password. Particularly concerning for installations using password-based authentication, this issue poses a grave risk for shared or public servers where session management is critical. The vulnerability was addressed in version 2.18.0, which introduced measures to enhance the security of session cookies.

References