JupyterHub Open Redirect Vulnerability

An open redirect vulnerability exists in JupyterHub versions through 5.4.3. This vulnerability allows attackers to create links that redirect users from the JupyterHub login page to an external, attacker-controlled site, bypassing JupyterHub's built-in redirect checks.

Impact

Exploitation of this vulnerability allows for open redirect, where users are sent to an external site of the attacker's choice after logging into JupyterHub.

Remediation

Users can upgrade to JupyterHub version 5.4.4 to address this vulnerability. Additionally, deployments can apply filters on the Location header in a reverse proxy such as nginx, Apache, or Traefik.