This vulnerability involves the ASGIRequest component of Django, where two variants of HTTP headers—those containing hyphens and those with underscores—are ambiguously mapped to a single header name with underscores. This ambiguity can be exploited by a remote attacker to spoof headers, potentially bypassing authentication mechanisms. Affected versions include Django 6.0 prior to 6.0.4, 5.2 prior to 5.2.13, and 4.2 prior to 4.2.30. Unsupported earlier versions such as 5.0.x, 4.1.x, and 3.2.x were not evaluated but may also be vulnerable. The issue was reported by Tarek Nakkouch. There is no vendor advisory or patch link provided at this time.

The vulnerability allows remote attackers to spoof HTTP headers due to ambiguous header mapping, which can lead to authentication bypass. This could enable unauthorized access depending on how the application relies on header values for authentication or authorization decisions. No known exploits are reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor official Django project communications for updates and apply any forthcoming patches promptly. Until a fix is available, carefully review and validate header handling in applications using affected Django versions to mitigate spoofing risks.