CVE-2026-6873

score

<0.1

cvss

3.1

epss

0.3%

published

2026-06-03

kev added

—

first seen

2026-10-21

Django 6.0 < 6.0.6 and 5.2 < 5.2.15 contain a cookie signature bypass caused by non-injective salt derivation in django.http.HttpRequest.get_signed_cookie, letting remote attackers use cookies in unintended contexts, exploit requires crafted cookie values.