CVE-2026-123535

Tornado before 6.6 does not validate the max age argument of RequestHandler.set cookie (also called by set signed cookie, set secure cookie, and clear cookie), allowing injection of additional Set-Cookie attributes. When an application passes attacker-influenced input as max age, an attacker can embed attributes such as Domain, Path, or Secure to widen the cookie's scope to parent paths or other subdomains.