CVE-2026-61592 in djust
Summary
by MITRE • 09/17/2026
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen `session_id` with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a `session_id` could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. This is fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal. As a workaround, disable the SSE transport.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the djust library prior to version 1.0.7 represents a critical authentication bypass mechanism rooted in improper session management for Server-Sent Events (SSE) transports. While WebSocket connections within the same framework correctly bound sessions to authenticated user principals, SSE implementations relied exclusively on client-supplied session identifiers without verifying ownership or binding them to specific identities. This architectural inconsistency created an environment where identity verification was effectively disabled for this transport method, allowing any entity possessing a valid session identifier to impersonate the legitimate owner of that session.
From a technical perspective, the flaw stems from the lack of server-side validation linking the SSE connection request to an active authentication context. In standard web application security models, sessions must be cryptographically bound to the user account upon creation and maintained through secure token exchange or cookie-based mechanisms that are opaque to clients. By allowing the client to choose the session identifier without subsequent binding checks, djust failed to enforce access control policies at the transport layer. This design oversight meant that once a session was established, any subsequent events dispatched via SSE were processed under the context of the original user who created it, regardless of whether the current connection originated from an authorized party or an attacker intercepting traffic through network sniffing or cross-site request forgery vectors.
The operational impact of this vulnerability is severe, as it enables complete account takeover for any user whose session identifier becomes known to a third party. An attacker could leverage tools such as browser developer consoles, malicious scripts, or man-in-the-middle attacks to capture the session ID and then inject event handlers that execute with full privileges of the victim. This includes accessing sensitive data, modifying application state, performing actions on behalf of the user, and potentially escalating privileges if those actions trigger administrative workflows. The risk is exacerbated by the real-time nature of SSE, which allows immediate execution of injected logic without requiring page reloads or additional authentication prompts, making detection difficult for both users and administrators in real time.
This issue aligns with CWE-287 Improper Authentication, as the system failed to properly verify identity before granting access to resources associated with a specific user session. Additionally, it relates to CWE-613 Insufficient Session Expiration due to the persistent nature of SSE connections that remain open and active until explicitly closed or timed out by server configuration rather than strict authentication checks during each event dispatch. In terms of MITRE ATT&CK framework mapping, this vulnerability facilitates Account Manipulation techniques where adversaries gain unauthorized access to existing accounts, potentially leading to lateral movement within an application ecosystem if the compromised account holds elevated permissions or can interact with other services via shared session tokens.
Mitigation strategies focus on enforcing strict binding between sessions and authenticated principals at the transport level. The primary remediation involves upgrading djust to version 1.0.7 or later, which implements mandatory principal validation during SSE session creation and rejects any attempts by non-owning entities to interact with existing sessions. For environments unable to upgrade immediately, disabling the SSE transport entirely eliminates the attack surface associated with this specific vulnerability vector. Organizations should also implement robust monitoring for anomalous session usage patterns, such as simultaneous connections from disparate geographic locations or unusual event dispatch frequencies, which may indicate active exploitation of unbound sessions. Regular security audits focusing on cross-transport consistency in authentication handling are recommended to prevent similar discrepancies across other communication channels within the application architecture.