GHSA-3vff-hjqv-m7h8

Source

https://github.com/advisories/GHSA-3vff-hjqv-m7h8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-3vff-hjqv-m7h8/GHSA-3vff-hjqv-m7h8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-3vff-hjqv-m7h8

Aliases

Published

2026-04-03T21:36:07Z

Modified

2026-07-13T07:26:28Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

JupyterHub has an Open Redirect Vulnerability

Details

Affected Version

JupyterHub <= 5.4.3

Impact

An open redirect vulnerability in JupyterHub <=5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a JupyterHub page, bypassing JupyterHub's check to prevent this.

Patches

Upgrade to JupyterHub 5.4.4

Workarounds

A deployment can apply filters on the Location header in a reverse proxy such as nginx/apache/traefik.

Database specific

{
    "cwe_ids":  [
        "CWE-601"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-04-03T21:36:07Z",
    "nvd_published_at":  "2026-04-03T22:16:26Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / jupyterhub

Package

Name: jupyterhub; View open source insights on deps.dev
Purl: pkg:pypi/jupyterhub

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.4.4

Affected versions

0.*

0.1.0

0.2.0

0.3.0

0.4.0

0.4.1

0.5.0

0.6.0

0.6.1

0.7.0b1

0.7.0

0.7.1

0.7.2

0.8.0b1

0.8.0b2

0.8.0b3

0.8.0b4

0.8.0b5

0.8.0rc1

0.8.0rc2

0.8.0

0.8.1

0.9.0b1

0.9.0b2

0.9.0b3

0.9.0rc1

0.9.0

0.9.1

0.9.2

0.9.3

0.9.4

0.9.5

0.9.6

1.*

1.0.0b1

1.0.0b2

1.0.0

1.1.0b1

1.1.0

1.2.0b1

1.2.0

1.2.1

1.2.2

1.3.0

1.4.0

1.4.1

1.4.2

1.5.0

1.5.1

2.*

2.0.0b1

2.0.0b2

2.0.0b3

2.0.0rc1

2.0.0rc2

2.0.0rc3

2.0.0rc4

2.0.0rc5

2.0.0

2.0.1

2.0.2

2.1.0

2.1.1

2.2.0

2.2.1

2.2.2

2.3.0

2.3.1

3.*

3.0.0b1

3.0.0

3.1.0

3.1.1

4.*

4.0.0b1

4.0.0b2

4.0.0

4.0.1

4.0.2

4.1.0

4.1.1

4.1.2

4.1.3

4.1.4

4.1.5

4.1.6

5.*

5.0.0b1

5.0.0b2

5.0.0

5.1.0

5.2.0

5.2.1

5.3.0rc0

5.3.0

5.4.0

5.4.1

5.4.2

5.4.3

Database specific

last_known_affected_version_range

"<= 5.4.3"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/04/GHSA-3vff-hjqv-m7h8/GHSA-3vff-hjqv-m7h8.json"