Skip to main content

Authentication Bypass by Spoofing

CVE-2026-3902

High
7.5/10

Summary

Django contains a header spoofing vulnerability in "ASGIRequest". Versions 6.0 through 6.0.3, 5.2 through 5.2.12, and 4.2 through 4.2.29 allow a remote attacker to spoof headers due to ambiguous mapping of header variants with hyphens or underscores to a single normalized version with underscores.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-290 - Authentication Bypass by Spoofing

This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.

References

Advisory Timeline

  • Published