CVE-2026-61592: 
Python vulnerability analysis and mitigation

CVE-2026-61592 is a session hijacking vulnerability in djust, a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance. Prior to version 1.0.7, Server-Sent Events (SSE) sessions were keyed solely by a client-chosen session_id with no binding to the authenticated user, allowing an attacker who obtains a victim's session_id to hijack the session and execute event handlers under the victim's identity. The vulnerability was originally published on June 22, 2026, and added to the GitHub Advisory Database on September 16, 2026. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory).

The root cause is a missing user-principal binding in the SSE transport layer of djust — a security control that exists in the WebSocket transport but was omitted for SSE (CWE-384: Session Fixation; CWE-639: Authorization Bypass Through User-Controlled Key; CWE-862: Missing Authorization). Because the session_id is entirely client-chosen and not validated against the authenticated user at session creation or message dispatch, any party who possesses or can guess/intercept a valid session_id can connect to the SSE message endpoint and trigger event handlers as the victim. Exploitation requires the attacker to first obtain a valid session_id (e.g., via network interception, social engineering, or information leakage), making attack complexity high. No public proof-of-concept code has been identified (GitHub Advisory, GitHub Security Advisory).

Successful exploitation allows an unauthenticated attacker to impersonate an authenticated user by connecting to the SSE message endpoint using a stolen or leaked session_id, dispatching event handlers that execute with the victim's identity and application state. This results in high confidentiality impact (access to victim's session data and application state) and high integrity impact (ability to perform actions on behalf of the victim), with no direct availability impact. The scope is limited to the affected application instance, but depending on the application's functionality, exploitation could lead to unauthorized data access, account takeover, or fraudulent actions performed under the victim's identity (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-61592. The EPSS score is approximately 0.29–0.39%, indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" at this time. Attack complexity is rated High due to the prerequisite of obtaining a valid victim session_id (GitHub Advisory).

1. Reconnaissance: Identify a target application using djust with the SSE transport enabled and running a version prior to 1.0.7 (e.g., by inspecting HTTP response headers, JavaScript bundles, or pip package metadata).
2. Obtain a victim session_id: Acquire a valid session_id through network interception (e.g., sniffing unencrypted traffic), social engineering (e.g., convincing a victim to share a URL containing the session_id), or exploiting an information disclosure vulnerability in the application.
3. Connect to the SSE message endpoint: Using the stolen session_id, establish a connection to the djust SSE message endpoint (e.g., via curl or a custom HTTP client), supplying the victim's session_id as the session key.
4. Dispatch event handlers: Send crafted event messages to the endpoint that trigger server-side event handlers, which execute with the victim's authenticated identity and application state.
5. Achieve objective: Leverage the hijacked session to read sensitive application state (confidentiality impact), perform unauthorized actions (integrity impact), or pivot to further attacks within the application (GitHub Advisory, GitHub Security Advisory).

• Network: Unexpected SSE connections to the djust message endpoint from IP addresses not associated with the legitimate authenticated user; multiple concurrent SSE connections sharing the same session_id from different source IPs.
• Logs: Application logs showing SSE session access from a different IP or user-agent than the original session creator; event handler executions attributed to a user who is not actively browsing the application.
• Application Behavior: Actions or state changes in a user's account that the user did not initiate, particularly during periods when the user is not actively connected; anomalous event handler invocations in server-side logs tied to a specific session_id.

Upgrade djust to version 1.0.7 or later, which binds each SSE session to its owning principal at creation and rejects cross-principal access; SSE session creation is also capped per principal to limit abuse. For deployments that cannot immediately upgrade, the recommended workaround is to disable the SSE transport entirely. No other configuration-based mitigations have been documented (GitHub Advisory, djust v1.0.7 Release).