CVE-2025-61669 is an open redirect vulnerability (CWE-601) in jupyter_server versions up to 2.17.0. The issue arises because the next query parameter in the login flow is insufficiently validated in the LoginFormHandler._redirect_safe() function, permitting redirection to arbitrary external domains via specially crafted values such as ///example.com. This flaw enables attackers to redirect users to malicious websites during the login process, potentially facilitating phishing attacks. The vulnerability has a CVSS 4.0 base score of 6.3 (medium severity). It is resolved in jupyter_server version 2.18.0.

An attacker can exploit this vulnerability to redirect users to malicious external websites during the login process, which may facilitate phishing attacks. There is no indication of privilege escalation, code execution, or data breach directly caused by this vulnerability. No known exploits in the wild have been reported.

Upgrade jupyter_server to version 2.18.0 or later, where this open redirect vulnerability is fixed. Since the vendor advisory confirms the issue is resolved in 2.18.0, applying this official fix is the recommended remediation. Patch status is confirmed by the vendor's versioning information. No additional mitigations are specified.