CVE-2026-6873
Gravedad CVSS v4.0:
BAJA
Tipo:
No Disponible / Otro tipo
Fecha de publicación:
03/06/2026
Última modificación:
03/06/2026
Descripción
*** Pendiente de traducción *** An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15.<br />
`django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation.<br />
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.<br />
Django would like to thank Peng Zhou for reporting this issue.
Impacto
Puntuación base 4.0
2.30
Gravedad 4.0
BAJA
Puntuación base 3.x
3.10
Gravedad 3.x
BAJA