The vulnerability in Django's ASGIRequest component involves ambiguous mapping of HTTP headers containing hyphens and underscores to a single underscore-based header name. This ambiguity allows remote attackers to spoof headers, potentially bypassing authentication mechanisms. Affected versions include Django 6.0 before 6.0.4, 5.2 before 5.2.13, and 4.2 before 4.2.30. Unsupported earlier versions might also be vulnerable. The issue is tracked as CWE-290 (Authentication Bypass by Spoofing) and has a CVSS 3.1 base score of 7.5, indicating high severity. No vendor advisory or patch links are provided, and no known exploits have been reported.

The impact of this vulnerability is a high-severity authentication bypass, which could allow remote attackers to spoof headers and potentially gain unauthorized access or bypass authentication controls in affected Django applications. There is no indication of confidentiality or availability impact, but integrity is impacted due to authentication bypass.

Patch status is not yet confirmed — check the official Django vendor advisory for current remediation guidance. Since no patch or official remediation level is provided in the data, users should monitor Django security advisories for updates and apply updates to versions 6.0.4, 5.2.13, or 4.2.30 or later once available. Until then, consider reviewing header handling in ASGIRequest and applying any recommended temporary mitigations from the vendor.