CVE-2026-35192

MEDIUM

Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST

Title source: cna
STIX 2.1

Description

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.

References (3)

Core 3
Core References
Vendor Advisory vendor-advisory
Django security archive
https://docs.djangoproject.com/en/dev/releases/security/
Mailing List mailing-list
Django releases announcements
https://groups.google.com/g/django-announce
Vendor Advisory vendor-advisory
Django security releases issued: 6.0.5 and 5.2.14
https://www.djangoproject.com/weblog/2026/may/05/security-releases/

Scores

CVSS v3 6.5
EPSS 0.0004
EPSS Percentile 13.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-539
Status published
Products (7)
djangoproject/Django 5.2 - 5.2.14
djangoproject/django 5.2 - 5.2.14
djangoproject/Django 5.2.14
djangoproject/Django 6.0 - 6.0.5
djangoproject/Django 6.0.5
pypi/Django 5.2 - 5.2.14PyPI
pypi/Django 6.0 - 6.0.5PyPI
Published May 05, 2026
Tracked Since May 05, 2026