- Description
- An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.
- Source
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- NVD status
- Analyzed
- Products
- django
CVSS 4.0
- Type
- Secondary
- Base score
- 2.3
- Impact score
- -
- Exploitability score
- -
- Vector string
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity
- LOW
CVSS 3.1
- Type
- Primary
- Base score
- 4.3
- Impact score
- 1.4
- Exploitability score
- 2.8
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Severity
- MEDIUM
- 6a34fbeb-21d4-45e7-8e0a-62b95bc12c92
- CWE-347
- Hype score
- Not currently trending
5 CVEs in Django https://t.co/PCZNkRyzZI CVE-2026-6873: Signed cookie salt namespace collision in django.http.HttpRequest.get_signed_cookie CVE-2026-7666: Potential unencrypted email transmission via STARTTLS in the SMTP backend + next tweet
@oss_security
6 Jun 2026
997 Impressions
2 Retweets
6 Likes
0 Bookmarks
1 Reply
0 Quotes
June Django security release: 4 CVEs spanning cache middleware (CVE-2026-8404, CVE-2026-48587), STARTTLS downgrade in EmailBackend (CVE-2026-7666), signed cookie salt collision (CVE-2026-6873). Fix the STARTTLS one first. https://t.co/HpnyHhXXnp
@BunSnack
5 Jun 2026
6 Impressions
0 Retweets
2 Likes
0 Bookmarks
0 Replies
0 Quotes
[
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"matchCriteriaId": "048C450F-F81F-4A1D-9BF7-DC36FF26988E",
"versionEndExcluding": "5.2.15",
"versionStartIncluding": "5.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*",
"matchCriteriaId": "BC9BA685-D9CE-406E-A479-9C444E8EADB3",
"versionEndExcluding": "6.0.6",
"versionStartIncluding": "6.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
]