CVE-2026-6873
LowCVSS 3.1Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Vulnerability in Django (versions 6.0 before 6.0.6 and 5.2 before 5.2.15) in the `get_signed_cookie` function allows an attacker to use a signed cookie in a different context than intended, by manipulating the cookie name and salt argument. This is due to non-injective salt derivation.
Risk Assessment
Risk of session and authorization integrity compromise in Django applications, potentially allowing an attacker to impersonate another user or perform unauthorized actions.
Recommendation
Update Django to version 6.0.6 or 5.2.15 (or later). If using older unsupported series, consider migrating to a supported version.
Original NVD description (English source)
An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.