A vulnerability was found in jupyter-server jupyter_server up to 2.17.x. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file ~/.local/share/jupyter/runtime/jupyter_cookie_secret of the component Password Change Handler. Such manipulation leads to session expiration.
This vulnerability is uniquely identified as CVE-2026-40934. The attack can be launched remotely. No exploit exists.
It is recommended to upgrade the affected component.
