The vulnerability in Django's get_signed_cookie method stems from the way it derives the salt by concatenating the cookie name and the salt argument, which is non-injective. This allows an attacker to craft distinct (name, salt) pairs that produce the same concatenation, enabling reuse of a signed cookie in a different context. The issue affects Django 6.0 versions prior to 6.0.6 and 5.2 versions prior to 5.2.15. Earlier unsupported versions were not evaluated but may also be vulnerable. The CVSS score is 3.1, indicating low severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and limited confidentiality impact.

The impact is limited to potential misuse of signed cookies across different contexts due to improper cryptographic signature verification. The confidentiality impact is low, with no integrity or availability impact reported. There are no known exploits in the wild. The vulnerability could allow an attacker to bypass intended cookie context restrictions but does not lead to privilege escalation or data modification.

Patch status is not yet confirmed — check the official Django vendor advisory for current remediation guidance. Since no official patch or remediation level is provided in the data, users should monitor Django security advisories for updates. Avoid relying on affected versions in sensitive contexts until a fix is confirmed.