---
id: CVE-2023-23934
aliases:
  - GHSA-px8h-6qxv-m22q
  - PYSEC-2023-57
title: Incorrect parsing of nameless cookies leads to __Host- cookies bypass
summary: Incorrect parsing of nameless cookies leads to __Host- cookies bypass
severity: low
cvss: 2.6
cvssVector: 'CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'
vendor: werkzeug
product: werkzeug
ecosystem: pip
affected:
  - werkzeug < 2.2.3
patched:
  - werkzeug 2.2.3
published: '2023-02-15'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:07.890803222Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-px8h-6qxv-m22q'
references:
  - url: >-
      https://github.com/pallets/werkzeug/security/advisories/GHSA-px8h-6qxv-m22q
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-23934'
  - url: >-
      https://github.com/pallets/werkzeug/commit/cf275f42acad1b5950c50ffe8ef58fe62cdce028
  - url: 'https://github.com/pallets/werkzeug'
  - url: 'https://github.com/pallets/werkzeug/releases/tag/2.2.3'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/werkzeug/PYSEC-2023-57.yaml
  - url: 'https://security.netapp.com/advisory/ntap-20230818-0003'
  - url: 'https://www.debian.org/security/2023/dsa-5470'
tags:
  - osv
  - pip
epss: 0.00507
epssPercentile: 0.4228
ingestedAt: '2026-09-12T03:13:01.719Z'
---

## Overview

Browsers may allow "nameless" cookies that look like `=value` instead of `key=value`. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie like `=__Host-test=bad` for another subdomain.

Werkzeug <= 2.2.2 will parse the cookie `=__Host-test=bad` as `__Host-test=bad`. If a Werkzeug application is running next to a vulnerable or malicious subdomain which sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.

## Affected packages

- `werkzeug < 2.2.3`

## Remediation

Upgrade to a patched release:

- `werkzeug 2.2.3`