CVE-2026-35192
Session Fixation in Django Web Framework
Publication date: 2026-05-05
Last updated on: 2026-05-05
Assigner: Django Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| django | django | to 5.2.14 (exc) |
| django | django | to 6.0.5 (exc) |
| django | django | 3.2 |
| django | django | 4.1 |
| django | django | 5.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-539 | The web application uses persistent cookies, but the cookies contain sensitive information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-35192 is a session fixation vulnerability in Django versions before 6.0.5 and 5.2.14. The issue occurs because response headers do not vary on cookies if a session is not modified, but the setting SESSION_SAVE_EVERY_REQUEST is set to True. This allows a remote attacker to steal a user's session after the user visits a cached public page.
Earlier unsupported Django versions such as 5.0.x, 4.1.x, and 3.2.x may also be affected.
How can this vulnerability impact me? :
This vulnerability can allow a remote attacker to steal a user's session. If an attacker obtains a valid session, they can impersonate the user and potentially gain unauthorized access to the user's account or data.
The impact is considered low severity according to Django's security policy, but it still poses a risk of session hijacking when SESSION_SAVE_EVERY_REQUEST is enabled and cached public pages are visited.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Django to a fixed version later than 6.0.5 or 5.2.14 where the issue has been resolved.
Additionally, review your Django settings and consider disabling SESSION_SAVE_EVERY_REQUEST if it is set to True, as this setting is related to the vulnerability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.