CVE-2026-40934

Description

## Summary A persistent cookie secret vulnerability allows authenticated users to maintain indefinite access even after password changes. The cookie secret used to sign authentication cookies is stored in a permanent file (`~/.local/share/jupyter/runtime/jupyter_cookie_secret`) that is never automatically rotated or cleared, allowing stolen or compromised cookies to remain valid indefinitely regardless of password resets. ## PoC - Start a Jupyter server with password authentication: `jupyter server password`, `jupyter server` - Log in with the password and capture the authentication cookie (e.g., just login with a browser). - Change the password to revoke access: `jupyter server password` - Restart the server - Use the old stolen cookie => remains valid and provides full authenticated access. ## Impact - All jupyter-server deployments using password authentication where security incidents may occur - Multi-user systems where one user's compromised session should be revocable by administrators - Shared or public-facing Jupyter servers where credential rotation is a security requirement - Any deployment where password changes are expected to revoke existing sessions ## Patches Jupyter Server 2.18+ ## Workaround ```bash rm ~/.local/share/jupyter/runtime/jupyter_cookie_secret # Then restart the server ```

Affected packages (3)

• Debian/jupyter-serverfrom 0
• PyPI/jupyter-serverfrom 0, < 2.18.0
• PyPI/jupyter-serverfrom 0, < 2.18.0

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-40934
• ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2026-40934
• PATCHhttps://github.com/jupyter-server/jupyter_server
• WEBhttps://github.com/jupyter-server/jupyter_server/security/advisories/GHSA-5mrq-x3x5-8v8f