CVE-2026-61592

The djust Python package (a live-view framework with SSE and WebSocket transports) keyed its Server-Sent Events sessions solely on a client-chosen session_id, with no binding to the authenticated user — a check the WebSocket transport has but that was dropped for SSE. An attacker who learns or obtains a victim's session_id (through leakage, logs, or guessing) can connect to the SSE message endpoint and dispatch event handlers that execute with the victim's identity and state, gaining unauthorized read access and the ability to perform actions as the victim. Exploitation requires obtaining a valid session_id, which the CVSS score reflects as high attack complexity, but there is no other authorization gate. All djust deployments using the SSE transport on versions prior to 1.0.7 are affected. No public proof-of-concept exists and no exploitation has been reported; the flaw is fixed in djust 1.0.7, which binds each SSE session to its owning principal and caps sessions per principal.

What to do: Upgrade to djust 1.0.7 or later, which binds each SSE session to its owning principal and rejects cross-principal access. If upgrading is not immediately possible, disable the SSE transport (e.g., use the WebSocket transport) as a workaround. Treat any session_ids that may have been shared or logged as compromised, and review server logs for unexpected connections to the SSE message endpoint.