CVE-2026-91991 — Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keywo…
Published: 2026-09-15 · CVSS: 6.3 · CVSS 4.0
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7