Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Django Use of Persistent Cookies Containing Sensitive Information Vulnerability - CVE-2026-35192 - Vulnerability Database
Django

Django Use of Persistent Cookies Containing Sensitive Information Vulnerability - CVE-2026-35192

Medium
Reference: CVE-2026-35192
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-35192
Title: Django Use of Persistent Cookies Containing Sensitive Information Vulnerability
Overview:

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified but SESSION_SAVE_EVERY_REQUEST is True. A remote attacker can steal a user39s session after that user visits a cached public page. Earlier unsupported Django series (such as 5.0.x 4.1.x and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.