Jupyter Server prior to version 2.18.0 persists the secret key used to sign authentication cookies in a static file (~/.local/share/jupyter/runtime/jupyter_cookie_secret) that is not rotated when a user changes their password. Consequently, any authentication cookie issued before the password reset remains valid, allowing an attacker who has captured such a cookie to maintain authenticated access despite password changes. This is a CWE-613 (Insufficient Session Expiration) vulnerability impacting password-based authentication, particularly in environments where session invalidation after credential changes is critical.

An attacker who obtains a valid session cookie before a password reset can continue to access the Jupyter Server with full authentication privileges even after the password has been changed. This undermines the security expectation that password resets revoke existing sessions, potentially allowing unauthorized persistent access to sensitive data or functionality on affected servers.

This vulnerability is fixed in Jupyter Server version 2.18.0. Users should upgrade to version 2.18.0 or later to ensure that the cookie signing secret is rotated upon password changes, invalidating previously issued authentication cookies. Since no official patch link or vendor advisory is provided, verify the upgrade and patch status from the official Jupyter Server release notes or repository. Patch status is not yet confirmed from vendor advisory; check vendor sources for current remediation guidance.