CVE-2026-61593

djust, a Python (pip) LiveView framework, left its Server-Sent-Events transport open to cross-site request forgery: the SSE client-to-server POST endpoints were decorated @csrf_exempt and the SSE GET stream endpoint performed no Origin check. An attacker hosts a web page that forces a victim's browser to GET the stream URL (which creates and mounts a LiveView using the victim's cookies) and then POSTs to the message endpoint with credentials included, using a client-chosen session_id and a text/plain JSON body that qualifies as a CORS simple request with no preflight. This lets the attacker fire state-changing, victim-authenticated event handlers on the server, with high confidentiality and integrity impact but no availability impact (CVSS 3.1: 8.1). Any djust application that exposes the SSE transport to authenticated users is affected. No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not listed in CISA KEV.

What to do: Upgrade to djust 1.0.7, which validates the request Origin against ALLOWED_HOSTS on all three SSE endpoints (rejecting cross-origin requests with 403) and requires Content-Type: application/json on POST endpoints (415 otherwise). If upgrading is not immediately possible, disable the SSE transport or place a reverse proxy in front of the SSE endpoints that enforces an Origin allowlist. Audit any djust application that uses SSE with cookie-authenticated LiveViews, since only those deployments are exposed to this flaw.