JupyterLab versions prior to 3.6.7, between 4.0.0 and before 4.0.11, and before 4.6.3 are vulnerable to a flaw that may expose users' Authorization and XSRF tokens if they click on a malicious link while running an older jupyter-server version. This vulnerability can lead to token leakage, potentially compromising user sessions. Patches have been released in JupyterLab 3.6.7, 4.0.11, and 4.1.0b2. Users are advised to upgrade jupyter-server to version 2.7.2 or newer to mitigate the issue. No workaround other than upgrading has been identified.