CVE-2026-61593: Cross-Site Request Forgery in djust Server-Sent Events Transport Layer
Vulnerability ID: CVE-2026-61593
CVSS Score: 8.1
Published: 2026-09-16
CVE-2026-61593 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability discovered in the Server-Sent Events (SSE) transport layer of djust, an open-source framework that implements Phoenix LiveView-style reactive server-side rendering for Django applications. Before version 1.0.7, a lack of origin verification on the SSE stream endpoint, combined with @csrf_exempt decorators on message POST endpoints, allowed an attacker to hijack active client sessions through cross-origin interactions.
TL;DR
A validation omission in djust allows attackers to hijack reactive user sessions via cross-site requests, mounting unauthorized server-side components and executing state-changing handlers.
⚠️ Exploit Status: POC
Technical Details
- CWE ID: CWE-352: Cross-Site Request Forgery (CSRF)
- Attack Vector: Network
- CVSS v3.1 Score: 8.1
- Impact: High (Confidentiality, Integrity)
- Exploit Status: poc
- KEV Status: Not Listed
Affected Systems
- Applications utilizing the djust framework for Django reactive server-side rendering
-
djust: < 1.0.7 (Fixed in:
1.0.7)
Mitigation Strategies
- Upgrade the djust Python package to version 1.0.7 or later.
- Implement Origin header validation in intermediate reverse proxies.
- Reject non-JSON Content-Type values on POST requests targeting SSE message endpoints.
Remediation Steps:
- Update your requirements.txt or Pipfile to specify djust>=1.0.7.
- Re-deploy the application to apply the package update.
- Verify the fix by attempting a cross-origin connection using an unauthorized Origin header.
References
Read the full report for CVE-2026-61593 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)