{"id":"CVE-2026-123535","published":"2026-11-08T02:16:43.917","lastModified":"2026-11-08T02:16:44.053","description":"Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by set_signed_cookie, set_secure_cookie, and clear_cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max_age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.","cvssScore":4.2,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cwes":["CWE-74"],"vendors":[],"products":[],"references":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c6v4-qj2h-f748","tags":[]},{"url":"https://www.vulncheck.com/advisories/tornado-before-6.6-cookie-attribute-injection-via-set-cookie-max-age","tags":[]}],"exploitRefs":[{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-c6v4-qj2h-f748","tags":[]}],"hasPoc":true,"ai":null}