CVE-2026-40934 - jupyter-server authentication cookies remain valid after password reset due to static cookie secret

CVE ID :CVE-2026-40934 Published : May 5, 2026, 9:31 p.m. | 56 minutes ago Description :Jupyter Server is the backend for Jupyter web applications. In versions 2.17.0 and earlier, the secret used to sign authentication cookies is persisted to a static file at ~/.local/share/jupyter/runtime/jup