CVE-2026-35192

A flaw was found in Django. When the SESSIONSAVEEVERYREQUEST setting is enabled, response headers do not properly vary on cookies for unmodified sessions. This vulnerability allows a remote attacker to steal a user's session after the user visits a cached public page, leading to unauthorized acce...