Is CVE-2026-6873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-6873 being exploited in the wild.

How severe is CVE-2026-6873?

Low severity, with a CVSS score of 3.1, published 3 June 2026.

Which products and versions are affected?

Django (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.15, ECOSYSTEM:introduced=5.2,fixed=5.2.15,introduced=6.0,fixed=6.0.6.

Is there a fix for CVE-2026-6873?

Yes. Django (PyPI): upgrade to 5.2.15, 6.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-6873 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-6873?

Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-6873: Django salt namespace collision in get_signed_cookie

CVE-2026-6873 · Severity: low · CVSS 3.1 · Published 2026-06-03

Django, a popular web framework, contains a flaw in how it handles signed cookies used to verify data integrity. An attacker could potentially reuse a security cookie in a different part of the application than intended by exploiting how the system generates internal security keys. This could lead to unauthorized access to specific data or features that rely on these cookies for validation.

Technologies: Django (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-6873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-6873 being exploited in the wild.
How severe is CVE-2026-6873?: Low severity, with a CVSS score of 3.1, published 3 June 2026.
Which products and versions are affected?: Django (PyPI) ECOSYSTEM:introduced=0,fixed=5.2.15, ECOSYSTEM:introduced=5.2,fixed=5.2.15,introduced=6.0,fixed=6.0.6.
Is there a fix for CVE-2026-6873?: Yes. Django (PyPI): upgrade to 5.2.15, 6.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6873 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-6873?: Check whether you run Django (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Django (PyPI): upgrade to 5.2.15, 6.0.6 or later
```
pip install "Django>=6.0.6"
```

Technical details

The `django.http.HttpRequest.get_signed_cookie` function in Django uses a non-injective salt derivation method by concatenating the cookie name and the salt argument. This flaw allows for salt namespace collisions where distinct `(name, salt)` pairs produce the same concatenated string. A remote attacker with low privileges can exploit this to use a signed cookie in a context different from the one where it was originally signed. The issue affects Django versions before 5.2.15 and 6.0.x before 6.0.6; older unsupported versions may also be impacted. Patches have been released in versions 5.2.15 and 6.0.6.

Affected products

Django Software Foundation Django < 5.2.15, >= 6.0.0, < 6.0.6

Identifiers

CVE-2026-6873
GHSA-h7pc-vwp9-298g
PYSEC-2026-199

Timeline

2026-06-03: advisory
2026-06-03: disclosed
2026-06-03: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.