7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-40934

CVE-2026-40934: jupyter-server authentication cookies remain valid after password reset due to static cookie secret

Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jupyter_cookie_secret and is never rotated when a user changes their password. After a password reset and server restart, any previously issued authentication cookie remains cryptographically valid because the signing key has not changed. An attacker who has captured a session cookie through any means retains full authenticated access to the server regardless of subsequent password changes. This affects deployments using password-based authentication, particularly shared or public-facing servers where credential rotation is expected to revoke existing sessions. This issue has been fixed in version 2.18.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-40934

CVE-2026-40934:

7.6

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
jupyter-server	pip	<= 2.17.0	2.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the way Jupyter Server generates and persists the cookie secret for authentication. The advisory GHSA-5mrq-x3x5-8v8f states that the cookie secret is stored in a file and not rotated or cleared upon password changes. The provided patch addresses this by modifying the cookie secret generation process to include the user's password.

The key change is in the _default_cookie_secret method within jupyter_server/serverapp.py. The patch introduces a call to self.identity_provider.cookie_secret_hook(h), which in turn updates the HMAC with the user's hashed password. This ensures that any change in the password will result in a new cookie secret, effectively invalidating all previously issued cookies. The function ServerApp._default_cookie_secret is therefore the place where the vulnerable logic existed, as it was responsible for creating a static cookie secret that did not account for password changes.

Vulnerable functions

ServerApp._default_cookie_secret

jupyter_server/serverapp.py

The `_default_cookie_secret` function in `jupyter_server/serverapp.py` is responsible for generating the cookie secret. Prior to the patch, this function did not incorporate the user's password into the secret. As a result, changing the password did not invalidate existing authentication cookies, allowing an attacker with a stolen cookie to maintain access even after a password reset.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.