MEDIUM

CVE-2026-91991

2026-09-15 CVSS v3.1

CVSS

5.4

Description

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

Weakness (CWE)

CWE-113

EPSS Score

0.22%

Probability of exploitation in next 30 days

12.6th percentile

References

https://github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889x https://www.vulncheck.com/advisories/tornado-before-6.5.8-cookie-attribute-injection-via-capitalized-kwargs

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE