Livebook CVE-2026-66885

The target Livebook instance must be explicitly configured to use Livebook Teams as the ZTA identity provider - instances using alternative authentication or running without Teams integration are entirely unaffected. The attacker must hold active membership in the same Livebook Teams organization as the target instance (confirmed by CVSS 4.0 PR:L). The victim must be socially engineered into opening a crafted callback URL (confirmed by CVSS 4.0 UI:A), and the attack must complete within the short expiration window of the attacker's unredeemed authorization code, constraining timing. What limits exploitation: attacker must be an existing organizational member (insider threat vector), victim interaction is mandatory and cannot be automated, the authorization code has a short time-to-live, and no credential belonging to the victim is involved or exfiltrated - only session binding is affected.

The CVSS 4.0 score of 6.8 with vector AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N reflects a meaningful but constrained threat. The PR:L metric is the most significant limiting factor: the attacker must hold active membership in the same Livebook Teams organization as the target instance, ruling out external opportunistic attackers. UI:A further constrains feasibility, as the victim must be induced to open a crafted URL within the short authorization code redemption window. No EPSS score was included in the provided intelligence data and cannot be stated numerically. The vulnerability is not listed in the CISA KEV catalog, and no public exploit code has been identified. The real-world risk is most acute in multi-tenant or collaborative Livebook Teams deployments where organizational membership does not imply full trust - for example, shared research environments or organizations with many members. Single-user or tightly access-controlled deployments face substantially lower practical risk. The VC:H metric is accurate given that victim-produced secrets, notebook outputs, and uploaded data are attributable to and visible from the attacker's account.

An attacker who is a legitimate member of the target Livebook Teams organization initiates the OAuth login flow, captures the resulting short-lived authorization code, but does not redeem it. The attacker then constructs a crafted callback URL embedding that code and delivers it to a victim via phishing or a shared link, timing the delivery within the code's validity window. The victim's browser completes the token exchange with Livebook, binding the victim's session to the attacker's Teams identity, after which all notebooks run, secrets accessed, and data uploaded in that session are attributed to and readable by the attacker.