CVE-2026-35192: Session fixation via public cached pages and SESSION_SAVE_EVERY_REQUEST
An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but `SESSION_SAVE_EVERY_REQUEST` is `True`. A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Django would like to thank Cantina for reporting this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35192?
CVE-2026-35192 is classified as a vulnerability that allows session fixation due to predictable response headers.
How do I fix CVE-2026-35192?
To fix CVE-2026-35192, upgrade your Django installation to version 6.0.5 or later, or to version 5.2.14 or later.
What are the potential impacts of CVE-2026-35192?
A successful exploit of CVE-2026-35192 could allow an attacker to steal user sessions, compromising user accounts.
Which versions of Django are affected by CVE-2026-35192?
Django versions prior to 6.0.5 and prior to 5.2.14 are affected by CVE-2026-35192.
What defensive measures can be taken against CVE-2026-35192?
Enforcing proper session management practices, such as avoiding the use of SESSION_SAVE_EVERY_REQUEST set to True, can help mitigate CVE-2026-35192.