CVE-2026-61592: 
Python vulnerability analysis and mitigation

CVE-2026-61592 is a session hijacking vulnerability in djust, a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance. SSE (Server-Sent Events) sessions were keyed solely by a client-chosen session_id with no binding to the authenticated user, allowing an attacker who obtains a victim's session_id to hijack the session and execute event handlers under the victim's identity. All versions of djust prior to 1.0.7 are affected. The vulnerability was published on June 22, 2026, and carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause is that the SSE transport in djust used a client-supplied session_id as the sole authorization key, without binding sessions to the authenticated principal — a security control that existed in the WebSocket transport but was omitted from the SSE implementation. This maps to CWE-384 (Session Fixation), CWE-639 (Authorization Bypass Through User-Controlled Key), and CWE-862 (Missing Authorization). An attacker who learns a victim's session_id (e.g., through network interception, log exposure, or social engineering) can connect to the SSE message endpoint and dispatch event handlers that execute with the victim's server-side identity and state, requiring no authentication of their own (GitHub Advisory, djust Security Advisory).

Successful exploitation allows an unauthenticated attacker to fully impersonate an authenticated victim within the djust SSE session, resulting in high confidentiality and integrity impact. The attacker can read sensitive application state and data accessible to the victim, and dispatch server-side event handlers to perform unauthorized actions on the victim's behalf. Availability is not directly impacted, but the ability to act as any user whose session_id is known poses significant risk to multi-user Django applications using the SSE transport (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-61592. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires the attacker to first obtain a valid victim session_id, which introduces complexity (CVSS Attack Complexity: High), but no privileges or user interaction are required once the session_id is known (GitHub Advisory, Feedly).

1. Reconnaissance: Identify a target Django application using djust with the SSE transport enabled and running a version prior to 1.0.7.
2. Obtain a victim's session_id: Acquire a valid session_id through network interception (e.g., sniffing unencrypted traffic), log file exposure, social engineering, or by observing SSE connection URLs shared by the victim.
3. Connect to the SSE message endpoint: Using the obtained session_id, establish a connection to the djust SSE message endpoint, substituting the victim's session_id as the session key. No authentication credentials are required.
4. Dispatch event handlers: Send crafted event messages to the endpoint; the server processes these with the victim's authenticated identity and server-side state, allowing the attacker to read sensitive data or trigger state-changing actions on behalf of the victim (GitHub Advisory).

• Network: Unexpected SSE connections to the djust message endpoint from IP addresses not associated with the legitimate authenticated user; multiple concurrent SSE sessions sharing the same session_id from different source IPs.
• Logs: Application logs showing SSE session access from unusual or mismatched client IPs for a given session_id; event handler dispatches occurring outside normal user activity patterns or from unexpected geographic locations.
• Application Behavior: Unauthorized state changes or actions performed under a user's identity without corresponding user-initiated requests; anomalous event handler invocations in server-side logs tied to a specific session.

Upgrade djust to version 1.0.7 or later, which binds each SSE session to its owning principal at creation and rejects cross-principal access; SSE session creation is also capped per principal to limit abuse. As an immediate workaround for deployments that cannot upgrade, disable the SSE transport entirely. The patch is available via pip and the official GitHub release (djust v1.0.7 Release, GitHub Advisory).