Django Signed Cookie Salt Namespace Collision Vulnerability

A vulnerability exists in Django versions 6.0 prior to 6.0.6 and 5.2 prior to 5.2.15, in the `django.http.HttpRequest.get_signed_cookie` method. The issue arises from a non-injective salt derivation process, where the cookie name and salt argument are simply concatenated. This allows remote attackers to manipulate cookies by using different `(name, salt)` pairs that result in the same concatenation, potentially leading to unauthorized cookie acceptance in different contexts. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) may also be affected.

Impact

Exploitation of this vulnerability could lead to a signed cookie salt namespace collision, allowing cookies to be accepted in an incorrect context.

Remediation

Users can upgrade to Django versions 6.0.6 or 5.2.15 to address this vulnerability.