PT-2026-30867 · Djangoproject · Django

Jacob Walls + 1 · Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-3902

NVD

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

An issue was discovered in 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. ASGIRequest allows a remote attacker to spoof headers by exploiting an ambiguous mapping of two header variants (with hyphens or with underscores) to a single version with underscores. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Tarek Nakkouch for reporting this issue.

Fix

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

CVE-2026-3902

Affected Products

Django

References · 4

• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://djangoproject.com/weblog/2026/apr/07/security-releases · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3902 · Security Note
• https://groups.google.com/g/django-announce · Note