CVE-2014-0473: Django - Reuse of CSRF Token for Anonymous Users
Summary
CVE-2014-0473: The caching framework in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 reuses a cached CSRF token for all anonymous users, which allows remote attackers to bypass CSRF protecti... Affects django across 3 version ranges.
< 1.4.11
>= 1.5, < 1.5.6
>= 1.6, < 1.6.3
Fixed in 1.4.11, 1.5.6 or 1.6.3, depending on the release line you run. How to fix ↓
Also tracked for
- python-django · Debian:11
The same CVE-2014-0473 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Django is a popular Python web framework that provides a set of tools and libraries for building web applications. It includes a caching framework that allows developers to store frequently accessed data in memory for faster retrieval. One of the features provided by Django is Cross-Site Request Forgery (CSRF) protection, which helps prevent unauthorized actions by verifying the origin of requests. However, prior to versions 1.4.11, 1.5.6, 1.6.3, and 1.7 beta 2, Django's caching framework had a vulnerability that allowed remote attackers to bypass CSRF protections for anonymous users.
Vulnerability Detail
The vulnerability in Django's caching framework arises from the reuse of a cached CSRF token for all anonymous users. A CSRF token is a unique value generated by the server and included in a cookie or form field. It is used to validate the authenticity of requests and prevent CSRF attacks. In the affected versions of Django, the same CSRF token was used for all anonymous users, making it possible for an attacker to read the CSRF cookie of one user and use it to bypass CSRF protections for other anonymous users. This could lead to unauthorized actions being performed on behalf of those users, potentially compromising the security of the application.
How To Fix
Latest published version: 6.1.2 as of 22 Oct 2026
pip install --upgrade "django==6.1.2"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 1.4.111.4.11pip install --upgrade "django==1.4.11" -
>= 1.5, < 1.5.61.5.6pip install --upgrade "django==1.5.6" -
>= 1.6, < 1.6.31.6.3pip install --upgrade "django==1.6.3"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. The recommended solution is to upgrade to a fixed version of Django.
Conclusion
The vulnerability in Django's caching framework allows remote attackers to bypass CSRF protections for anonymous users. To mitigate this issue, it is crucial to upgrade to a fixed version of Django. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for django →
FAQ
Django is a Python web framework that simplifies the process of building web applications. It provides a set of tools and libraries for handling common web development tasks.
A CSRF token is a unique value generated by the server and included in a cookie or form field. It is used to validate the authenticity of requests and prevent CSRF attacks.
This vulnerability allows remote attackers to bypass CSRF protections for anonymous users in Django applications. It could lead to unauthorized actions being performed on behalf of those users.
Versions of Django prior to 1.4.11, 1.5.6, 1.6.3, and 1.7 beta 2 are affected by this vulnerability.
To fix this vulnerability, you should upgrade your Django installation to version 1.4.11, 1.5.6, 1.6.3, or 1.7 beta 2, or a later release.
Related vulnerabilities
Recent vulnerabilities recorded for django.
