CVE-2026-35192

An issue was discovered in 6.0 before 6.0.5 and 5.2 before 5.2.14. Response headers do not vary on cookies if a session is not modified, but "SESSIONSAVEEVERYREQUEST" is "True". A remote attacker can steal a user's session after that user visits a cached public page. Earlier, unsupported Django...