CVE-2026-61593: djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
Impact The SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with credentials: include to fire state-changing event handlers as the victim. The URL sessionid is client-chosen (validated only for UUID format), so it is not a CSRF token, and a JSON body sent as text/plain is a CORS simple request with no preflight.
Patches Fixed in djust 1.0.7. All three SSE endpoints validate the request Origin against ALLOWEDHOSTS (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require Content-Type: application/json (415 otherwise), closing the text/plain simple-request bypass.
Workarounds Disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.
Other sources
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with credentials: include to fire state-changing event handlers as the victim. The URL sessionid is client-chosen (validated only for UUID format), so it is not a CSRF token, and a JSON body sent as text/plain is a CORS simple request with no preflight. The issue is fixed in 1.0.7. All three SSE endpoints validate the request Origin against ALLOWEDHOSTS (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require Content-Type: application/json (415 otherwise), closing the text/plain simple-request bypass. As a workaround, disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Upgrade
Upgrade
djustto a version that resolves this vulnerability.Fixed in 1.0.7 - Configuration
Disable the SSE transport (workaround) or otherwise ensure SSE is not accessible cross-origin.
djust SSE transport enable_sse_transport = false - Compensating control
If SSE must remain enabled, front it with a proxy that enforces an Origin allowlist (so requests with disallowed Origin are rejected).
Event History
Frequently Asked Questions
Which deployments are exposed?
djust deployments using the SSE transport before version 1.0.7 are exposed. The issue affects the SSE stream GET endpoint and the client-to-server POST endpoints.
What does an attacker need to exploit this?
An attacker needs a victim who is authenticated to the target application with cookies and who visits an attacker-controlled cross-origin page. That page can cause the victim browser to create an SSE-backed LiveView session and send state-changing events using the victim's credentials.
Does the client-supplied session_id prevent exploitation?
No. The session_id is chosen by the client and is validated only as a UUID-format value, so it does not act as a CSRF token.
What can be done if upgrading is not immediately possible?
Disable the SSE transport, or place it behind a proxy that enforces an Origin allowlist. The fixed release validates Origin against ALLOWED_HOSTS for all SSE endpoints.
How does version 1.0.7 block the attack?
Version 1.0.7 rejects cross-origin requests to all SSE endpoints with HTTP 403 and requires application/json on the POST endpoints, returning HTTP 415 for other content types. This prevents the text/plain CORS simple-request bypass.