Threats tagged 'ghsa-h7pc-vwp9-298g'

CVE-2026-6873 is a low-severity vulnerability in Django versions 6.0 and 5.2 where the get_signed_cookie function uses a non-injective salt derivation method. This flaw allows an attacker to reuse a signed cookie in a different context by exploiting distinct (name, salt) pairs that produce the same concatenation. The issue affects Django 6.0 before 6.0.6 and 5.2 before 5.2.15, with earlier unsupported versions possibly also affected. No official patch or remediation level has been confirmed yet.