Executive brief
djust is a Python real-time web framework that uses Server-Sent Events (SSE) to push updates to clients. The SSE implementation failed to bind sessions to the authenticated user, allowing an attacker who obtains a session ID to impersonate that user and execute actions with their identity and permissions. This could lead to unauthorized data access, modification, or account takeover.
Technical details
The vulnerability exists in djust's SSE transport layer, which uses a client-chosen session_id as the sole authorization mechanism without binding it to the authenticated user principal. This is a session fixation and authorization bypass vulnerability (CWE-384, CWE-639, CWE-862). An attacker who learns a valid session_id—either through direct observation, network interception, or social engineering—can connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. The attack requires network access but has high complexity due to the need to obtain the session ID. The fix in djust 1.0.7 binds each SSE session to its owning principal at creation time and rejects cross-principal access attempts, while also implementing per-principal session creation rate limiting. No patch bypass techniques are known, and upgrading or disabling the SSE transport mitigates the issue.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed: Advisory published by djust-org
- 2026-06-22: patched: Fixed in djust 1.0.7
- 2026-09-16: advisory: GitHub Advisory Database reviewed and published