CVE-2026-6873: djangoproject django

Vulnerability summary

CVE-2026-6873 is a medium (CVSS 4.3) vulnerability in djangoproject django. EPSS estimates a 0.28% chance of exploitation in the next 30 days, higher than 19.3% of scored vulnerabilities.

Timeline

1. 03-06-2026
   PublishedVulnerability first disclosed.
2. 03-06-2026
   Last modifiedVulnerability information updated.

Description

An issue was discovered in Django 6.0 before 6.0.6 and 5.2 before 5.2.15. `django.http.HttpRequest.get_signed_cookie` in Django uses a non-injective salt derivation (concatenating the cookie name and salt argument), which allows a remote attacker to use a cookie in a context different from the one where it was signed, via distinct `(name, salt)` pairs that produce the same concatenation. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Peng Zhou for reporting this issue.

• CWE-347Improper Verification of Cryptographic SignatureThe product does not verify, or incorrectly verifies, the cryptographic signature for data.