Session Fixation in Django - CVE-2026-35192

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU130191

Session Fixation in Django - CVE-2026-35192

Published: May 5, 2026


Vulnerability identifier: #VU130191
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-35192
CWE-ID: CWE-384
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to steal a user's session.

The vulnerability exists due to improper session handling in cached public pages when a session is not modified and SESSION_SAVE_EVERY_REQUEST is True. A remote attacker can leverage a cached public page visit by the victim to steal a user's session.

User interaction is required because the victim must visit a cached public page.


Affected software

Django
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Fedora
SUSE Package Hub 15
openSUSE Leap
openEuler
Ubuntu
python3-Django
python-django-help
python-django
python-django (Ubuntu package)
python311-Django
python-django4.2
python-django5
python-django6

How to mitigate CVE-2026-35192

Install security update from vendor's website.

Django - addressed in versions 5.2.14, 6.0.5
python3-Django - addressed in versions 2.2.27-23, 4.2.15-15
python-django-help - addressed in versions 2.2.27-23, 4.2.15-15
python-django - addressed in versions 2.2.27-23, 4.2.15-15
python-django (Ubuntu package) - addressed in versions 2:3.2.12-2ubuntu1.27, 3:4.2.11-1ubuntu1.16, 3:5.2.4-1ubuntu2.5, 3:5.2.9-0ubuntu4.1
python311-Django - update to 4.2.11-150600.3.56.1
python-django4.2 - update to 4.2.30-2.el9
python-django5 - addressed in versions 5.2.14-1.fc42, 5.2.14-1.fc43, 5.2.14-1.fc44
python-django6 - update to 6.0.5-1.fc44

External References

Related Security Bulletins