DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61592: CVE-2026-61592: Session Hijacking and Authorization Bypass in djust SSE Transport

#security #cve #cybersecurity

CVE-2026-61592: Session Hijacking and Authorization Bypass in djust SSE Transport

Vulnerability ID: CVE-2026-61592
CVSS Score: 7.4
Published: 2026-09-16

A high-severity session hijacking and authorization bypass vulnerability has been identified in the djust framework prior to version 1.0.7. The flaw resides in the Server-Sent Events (SSE) transport implementation, which keyed sessions solely by client-provided session identifiers without verifying session ownership or binding. This allows an attacker who possesses or guesses a victim's session identifier to send malicious post messages to execute arbitrary state machine event handlers under the identity and permissions of the victim.

TL;DR

The djust framework prior to 1.0.7 accepted client-supplied session IDs in the Server-Sent Events (SSE) transport without verifying user ownership, enabling session hijacking and unauthorized state execution.

Technical Details

  • CWE ID: CWE-384 / CWE-862
  • Attack Vector: Network
  • CVSS Score: 7.4
  • EPSS Score: 0.00
  • Impact: Session Hijacking / Privilege Escalation
  • Exploit Status: none
  • KEV Status: not listed

Affected Systems

  • djust-org djust framework, versions prior to 1.0.7
  • djust: < 1.0.7 (Fixed in: 1.0.7)

Code Analysis

Commit: e7f6751

Release version bump and security advisory fixes for session principal verification

Mitigation Strategies

  • Upgrade the djust library to version 1.0.7 or higher.
  • Disable the SSE transport layer in Django settings to force secure WebSocket transport fallback.
  • Correlate HTTP requests to detect cross-principal session interactions.

Remediation Steps:

  1. Verify the installed djust version in your requirements or environment files.
  2. Update djust package dependency to 1.0.7.
  3. Configure DJUST_SSE_ENABLED = False in settings.py if immediate patching is unavailable.
  4. Deploy the updated code to the target environments.
  5. Monitor reverse proxy and application gateway logs for anomalous cross-IP session identifiers.

References

Read the full report for CVE-2026-61592 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)