Jupyter Server's Authentication Cookies Remain Valid After Password Reset and Server Restart
High6.8CVE-2026-40934 · Published May 5, 2026 · updated Sep 10, 2026
## Summary A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes. The cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets. ## PoC - Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server` - Log in with the password and capture the authentication cookie (e.g., just login with a browser). - Change the password to revoke access: `jupyter server password` - Restart the server - Use the old stolen cookie => remains valid and provides full authenticated access. ## Impact - All jupyter-server deployments using password authentication where security incidents may occur - Multi-user systems where one user's compromised session should be revocable by administrators - Shared or public-facing Jupyter servers where credential rotation is a security requirement - Any deployment where password changes are expected to revoke existing sessions ## Patches...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| jupyter-server PyPI | < 2.18.0 | 2.18.0 |
Details and references
## Summary A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes. The cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets. ## PoC - Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server` - Log in with the password and capture the authentication cookie (e.g., just login with a browser). - Change the password to revoke access: `jupyter server password` - Restart the server - Use the old stolen cookie => remains valid and provides full authenticated access. ## Impact - All jupyter-server deployments using password authentication where security incidents may occur - Multi-user systems where one user's compromised session should be revocable by administrators - Shared or public-facing Jupyter servers where credential rotation is a security requirement - Any deployment where password changes are expected to revoke existing sessions ## Patches Jupyter Server 2.18+ ## Workaround ```bash rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret # Then restart the server ```
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-613
- Also known as
- CVE-2026-40934, PYSEC-2026-69
More Jupyter advisories
All Jupyter| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 6 | JupyterLab's command linker attributes in HTML enable one-click command execution from untrusted content High9.6May 6 | High9.6 | 4.5.7+1 more |
| May 5 | Jupyter: improper input validationHigh8.8May 5 | High8.8 | 4.5.7 |
| May 5 | JupyterHub has cross-origin form POSTs bypass XSRF (CWE-352)Medium5.4May 5 | Medium5.4 | 5.4.5 |
| May 5 | Jupyter Server has a CORS Origin Validation Bypass via `re.match()` in `allow_origin_pat`HighMay 5 | High | 2.18.0 |
| May 5 | Jupyter: path traversalHigh7.1May 5 | High7.1 | 2.18.0 |
| May 5 | Jupyter Server has an open redirection vulnerability in `next` query parameterMediumMay 5 | Medium | 2.18.0 |