PT-2026-45947 · Djangoproject · Django

Natalia Bidart + 2 · Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-6873

Mitre

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. django.http.HttpRequest.get signed cookie in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct (name, salt) pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-6873

Affected Products

Django

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-6873 · Security Note
• https://docs.djangoproject.com/en/dev/releases/security · Vendor Advisory
• https://djangoproject.com/weblog/2026/jun/03/security-releases · Vendor Advisory
• https://groups.google.com/g/django-announce · Note