CVE-2016-7401: Django Cookie Parsing Code Bypasses CSRF Protection

django Updated 02 Oct 2025

Summary

03/10/2016

Disclosed on

CVE-2016-7401

CVE

Yes i

Fix available

High

Severity

7.5

CVSS Score

CVE-2016-7401: The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies. Affects django across 2 version ranges.

< 1.8.15 >= 1.9, < 1.9.10

Fixed in 1.8.15 or 1.9.10, depending on the release line you run. How to fix ↓

Also tracked for

python-django · Debian:11

The same CVE-2016-7401 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Django is a popular Python web framework used for building web applications. It provides a robust set of tools and features for developers to create secure and scalable websites. The cookie parsing code in Django versions before 1.8.15 and 1.9.x before 1.9.10 is vulnerable to a security issue that allows remote attackers to bypass the intended CSRF (Cross-Site Request Forgery) protection mechanism. This vulnerability specifically affects sites that use Google Analytics.

Vulnerability Detail

The vulnerability arises from a flaw in the cookie parsing code of Django. By exploiting this flaw, remote attackers can set arbitrary cookies, bypassing the CSRF protection mechanism that Django provides. CSRF attacks can lead to unauthorized actions being performed on behalf of the victim user, potentially compromising the integrity and security of the web application. This vulnerability has the potential to impact the confidentiality, integrity, and availability of affected Django applications.

How To Fix

Latest published version: 6.1.2 as of 22 Oct 2026

pip install --upgrade "django==6.1.2"

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 1.8.15 1.8.15
```
pip install --upgrade "django==1.8.15"
```
>= 1.9, < 1.9.10 1.9.10
```
pip install --upgrade "django==1.9.10"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If upgrading Django is not immediately feasible, a possible workaround is to disable the use of Google Analytics on the affected site. By removing or disabling Google Analytics, the vulnerability can be mitigated as the specific interaction between Django's cookie parsing code and Google Analytics is what allows the bypass of CSRF protection. However, this workaround may impact the functionality and analytics capabilities provided by Google Analytics.

Conclusion

The vulnerability in Django's cookie parsing code allows remote attackers to bypass CSRF protection by setting arbitrary cookies. Upgrading Django to the fixed versions or disabling Google Analytics on the affected site can mitigate this vulnerability. It is recommended to update Django to the latest available version and take necessary precautions to ensure the security of Django applications. For further support on vulnerability remediation, you can contact DevNack.com.

See every vulnerability recorded for django →

FAQ

What is Django?

Django is a Python web framework that simplifies the process of building web applications. It provides a set of tools and features for developers to create secure and scalable websites.

What is CSRF protection?

CSRF (Cross-Site Request Forgery) protection is a security mechanism used to prevent unauthorized actions from being performed on behalf of a user. It ensures that requests made to a web application are legitimate and originated from the intended user.

How does this vulnerability impact Django applications?

This vulnerability allows remote attackers to bypass the CSRF protection mechanism in Django, potentially leading to unauthorized actions being performed on behalf of the victim user. It can compromise the integrity and security of affected Django applications.

How can I check if my Django application is affected by this vulnerability?

You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the Pipfile.lock file of your application.