PulseLinuxLINUX UPDATE INTELLIGENCE
CVE Database›Document archive›CVE-2026-91991

CVE-2026-91991

tornado: Tornado: Cookie attribute injection via capitalized keyword arguments

Loading…

Severity

Moderate

Red Hat Product Security

5.4

CVSS 3.1

Review impact separately from score.

Published · September 16, 2026

Updated · October 15, 2026

Description

A flaw was found in Tornado. An attacker can bypass security validation in the set_cookie function by using capitalized or legacy keyword arguments. This allows the attacker to inject arbitrary cookie attributes, such as Domain or SameSite, and modify cookie security settings. The consequence is the potential to manipulate cookie behavior, which could lead to unintended security impacts.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes