CVE-2023-23934

Werkzeug is a comprehensive WSGI web application library. Browsers may
allow “nameless” cookies that look like =value instead of key=value. A
vulnerable browser may allow a compromised application on an adjacent
subdomain to exploit this to set a cookie like =__Host-test=bad for
another subdomain. Werkzeug prior to 2.2.3 will parse the cookie
=__Host-test=bad as __Host-test=bad`. If a Werkzeug application is
running next to a vulnerable or malicious subdomain which sets such a
cookie using a vulnerable browser, the Werkzeug application will see the
bad cookie value but the valid cookie key. The issue is fixed in Werkzeug
2.2.3.