CVE-2026-66885: Livebook CSRF Vulnerability in Livebook Teams Identity Callback
Summary
CVE-2026-66885: Livebook Teams identity callback lacks state binding, allowing login CSRF. Affects livebook across 5 version ranges.
>= 0.15.0, < 0.18.7
>= 0.19.0, < 0.19.9
< 6ed2e213e9d5a19a70d7fcad5a8d616622cd2084
< 33a052daa386c4ce08a9c39a07fc90f353ff6a51
>= 4380a411920531223088267ed1c0ad21f96ef660, < 21c16168263275541a6e076d0c31852c40e09a18
Fixed in 0.18.7 or 0.19.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Livebook is an interactive notebook platform designed for data science and collaborative coding. It allows users to create, share, and execute code in real-time. The platform integrates with Livebook Teams for identity management, enabling users to authenticate and collaborate within teams. However, a recent vulnerability has been identified that compromises the security of user sessions when using Livebook Teams.
Vulnerability Detail
The vulnerability arises from a Cross-Site Request Forgery (CSRF) flaw in the Livebook Teams identity callback mechanism. When a user attempts to log in using Livebook Teams, the system does not generate a state or nonce value to bind the authentication request to the user's session. This oversight allows an attacker, who is a member of the same Livebook Teams organization, to initiate the login flow and trick a victim into completing the authentication process. As a result, the victim's session is hijacked, and actions performed in that session are attributed to the attacker's identity, exposing sensitive data and actions to the attacker.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 0.15.0, < 0.18.70.18.7 -
>= 0.19.0, < 0.19.90.19.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users should avoid using Livebook Teams for authentication until the package is updated to a secure version. Additionally, users can monitor their sessions for any unauthorized activity and ensure that they are not clicking on suspicious links.
Conclusion
CVE-2026-66885 presents a significant security risk for users of Livebook when using Livebook Teams for authentication. It is crucial for users to update to the latest patched versions to mitigate this vulnerability and protect their sessions from being hijacked.
See every vulnerability recorded for livebook →
FAQ
CVE-2026-66885 is a vulnerability in Livebook that allows an attacker to hijack a user's session when using Livebook Teams for authentication.
Users may unknowingly operate under an attacker's identity, leading to unauthorized access to sensitive data and actions being attributed to the attacker.
The vulnerability affects Livebook versions from 0.15.0 before 0.18.7 and from 0.19.0 before 0.19.9.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The CVSS score of this vulnerability is 6.8, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for livebook.
