The vulnerability arises from Django's get_signed_cookie method, which derives a signing key by concatenating the cookie name and a provided salt. This concatenation is not injective, allowing two distinct (name, salt) pairs that produce the same combined key, exposing an Insecure Key Derivation flaw (CWE-303) and a misuse of cookie names (CWE-347). Consequently, an attacker can use a cookie that was signed for one name in a different context where a different (name, salt) pair produces the same key, effectively bypassing the intended isolation between cookies.

Django versions 6.0 up to 6.0.5 and 5.2 up to 5.2.14 are vulnerable. The affected series include Django 6.0 and 5.2. Unverified older series such as 5.0.x, 4.1.x, and 3.2.x may also be impacted, but have not been evaluated by Django and therefore may remain vulnerable.

The CVSS score of 2.3 indicates low severity, highlighting modest impact when the flaw is exploited. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a network‑based request where the attacker injects a crafted signed cookie into an HTTP request; this inference is based on the fact that the flaw involves signed cookie handling in django.http.HttpRequest.get_signed_cookie.