CVE-2026-61592: djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)
Impact SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a sessionid could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state.
Patches Fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal.
Workarounds Disable the SSE transport short of upgrading.
Other sources
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a sessionid could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. This is fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal. As a workaround, disable the SSE transport.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Disable the SSE transport as a workaround short of upgrading.
djust SSE transport SSE transport = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the SSE transport are exposed because SSE sessions were not bound to the authenticated user. The affected component is pip/djust, and the issue is fixed in djust 1.0.7.
What does an attacker need to exploit it?
An attacker needs to learn a victim's client-chosen session_id, or the victim must leak that session_id. The attacker can then connect to the message endpoint and dispatch handlers under the victim's identity and state.
Is there a mitigation if upgrading is not immediately possible?
Disable the SSE transport. This removes the vulnerable transport path until djust can be upgraded to version 1.0.7.
How can I determine whether sessions have the vulnerable behavior?
The vulnerable behavior allows an SSE connection using a known session_id to access it without binding that session to the authenticated principal. In the fixed release, SSE sessions are bound to their owner and cross-principal access is rejected.