A bug in Django 6.0 prior to 6.0.5 and 5.2 prior to 5.2.14 allows an attacker to hijack a user’s session. When the setting SESSION_SAVE_EVERY_REQUEST is enabled, response headers for cached public pages do not vary on cookies if the session is unchanged. A remote attacker can then obtain the user’s legitimate session cookie from a cached page and use it to impersonate that user, potentially accessing or modifying sensitive data. This falls under CWE‑539 and can lead to confidentiality and integrity compromise for affected users.

The vulnerability affects Django versions 6.0 before 6.0.5 and 5.2 before 5.2.14. Earlier but unsupported series such as 5.0.x, 4.1.x, and 3.2.x may also be impacted, though they were not explicitly evaluated. All installations that enable SESSION_SAVE_EVERY_REQUEST and expose cached public pages without proper cache validation are at risk.

The CVSS score of 2.3 indicates low severity, but the vulnerability is remotely exploitable via cached content and is not yet listed in the CISA KEV catalog. The EPSS score is not available, so the exact likelihood of exploitation is uncertain. Likely an attacker could discover cached pages, capture session cookies, and then use them to impersonate users. The impact to a single session translates to potential compromise of user accounts and data for each affected application.