CVE-2009-5014: Turbogears TURBOGEARS2

High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days.

The default quickstart configuration of TurboGears2 (aka tg2) before 2.0.2 has a weak cookie salt, which makes it easier for remote attackers to bypass repoze.who authentication via a forged authorization cookie, a related issue to CVE-2010-3852.

Affected products

• Turbogears TURBOGEARS2: up to and including 2.1b2; version 1.9.7a2 only; version 1.9.7a3 only; version 1.9.7a4 only; version 1.9.7b1 only; version 1.9.7b2 only; …

Published 2010-11-06. Last modified 2026-06-16.