CVE-2026-40934: Jupyter server Jupyter Server's Authentication Cookies Remain Vulnerability
HIGHCVE-2026-40934 is a HIGH (CVSS 6.8) jupyter server's authentication cookies remain vulnerability (CWE-613: Insufficient Session Expiration) affecting Jupyter server libraries in the PyPI ecosystem. The issue involves jupyter server's authentication cookies remain valid after password reset and server restart. Remediation is available by upgrading affected packages to version 2.18.0.
CVE-2026-40934 at a Glance
Security Impact
CVSS: 6.8
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N).
How to Fix CVE-2026-40934
To remediate this vulnerability, upgrade all affected Jupyter server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
pip install jupyter-server>=2.18.0Run the following command in your project directory to verify that all resolved dependencies use the patched release:
pip show jupyter-serverHow to Check if You Are Affected
To determine whether your Python environment is affected by CVE-2026-40934, inspect your installed packages using pip:
pip show jupyter-serverAnalyze the terminal output to locate any version of Jupyter server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 2.18.0), your application is affected.
Note: The pip show jupyter-server command checks currently installed packages in your active Python environment.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-613: Insufficient Session Expiration, where according to wasc, "insufficient session expiration is when a web site permits an attacker to reuse old session credentials or session ids for authorization.". In Jupyter server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-40934 Affected Jupyter server Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
jupyter-server
|
PyPI |
< 2.18.0
|
2.18.0
|
References
Frequently Asked Questions
What is CVE-2026-40934?
Which Jupyter server versions are affected?
What version fixes CVE-2026-40934?
Is jupyter-server affected?
What is the CVSS score of CVE-2026-40934?
What CWE is associated with CVE-2026-40934?
How can I check PyPI dependencies for CVE-2026-40934?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-5mrq-x3x5-8v8f",
"modified" : "2026-06-06T00:27:08Z",
"published" : "2026-05-05T17:03:24Z",
"aliases" : [ "CVE-2026-40934" ],
"summary" : "Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart",
"details" : "## Summary\n\nA persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes. \n\nThe cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets.\n\n## PoC\n\n- Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server`\n- Log in with the password and capture the authentication cookie (e.g., just login with a browser).\n- Change the password to revoke access: `jupyter server password`\n- Restart the server\n- Use the old stolen cookie => remains valid and provides full authenticated access.\n\n## Impact\n\n- All jupyter-server deployments using password authentication where security incidents may occur\n- Multi-user systems where one user's compromised session should be revocable by administrators\n- Shared or public-facing Jupyter servers where credential rotation is a security requirement\n- Any deployment where password changes are expected to revoke existing sessions\n\n## Patches\n\nJupyter Server 2.18+\n\n## Workaround\n\n```bash\nrm ~/.local/share/jupyter/runtime/jupyter_cookie_secret\n# Then restart the server\n```",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "PyPI",
"name" : "jupyter-server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "2.18.0"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 2.17.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-40934"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/jupyter-server/jupyter_server"
}, {
"type" : "WEB",
"url" : "https://github.com/pypa/advisory-database/tree/main/vulns/jupyter-server/PYSEC-2026-69.yaml"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-613" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-05-05T17:03:24Z",
"nvd_published_at" : "2026-05-05T22:16:00Z"
}
}