CVE-2026-35192
Severity CVSS v4.0:
LOW
Type:
Unavailable / Other
Publication date:
05/05/2026
Last modified:
05/05/2026
Description
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14.<br />
Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user&#39;s session after that user visits a cached public page.<br />
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.<br />
Django would like to thank Cantina for reporting this issue.
Impact
Base Score 4.0
2.30
Severity 4.0
LOW