Medium severity5.4NVD Advisory· Published Sep 15, 2026· Updated Oct 8, 2026

CVE-2026-91991

Description

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Tornadoweb/Tornadollm-fuzzy
Range: <6.5.8

Patches

Vulnerability mechanics

References

github.com/tornadoweb/tornado/security/advisories/GHSA-wwv5-g3v4-889xnvd
www.vulncheck.com/advisories/tornado-before-6.5.8-cookie-attribute-injection-via-capitalized-kwargsnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000