CVE-2026-91991
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
- Published Sep 15, 2026
- CVSS 6.3 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)
- A fix is available