CVE-2026-61592: djust SSE session hijacking via client-chosen session_id

CVE-2026-61592 · Severity: high · CVSS 7.4 · Published 2026-09-16

djust is a Python real-time web framework that uses Server-Sent Events (SSE) to push updates to clients. The SSE implementation failed to bind sessions to the authenticated user, allowing an attacker who obtains a session ID to impersonate that user and execute actions with their identity and permissions. This could lead to unauthorized data access, modification, or account takeover.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61592 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61592 being exploited in the wild.
How severe is CVE-2026-61592?
High severity, with a CVSS score of 7.4, published 16 September 2026.
Which products and versions are affected?
djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.
Is there a fix for CVE-2026-61592?
Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61592 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61592?
Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djust (PyPI): upgrade to 1.0.7 or later
    pip install "djust>=1.0.7"

Technical details

The vulnerability exists in djust's SSE transport layer, which uses a client-chosen session_id as the sole authorization mechanism without binding it to the authenticated user principal. This is a session fixation and authorization bypass vulnerability (CWE-384, CWE-639, CWE-862). An attacker who learns a valid session_id—either through direct observation, network interception, or social engineering—can connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. The attack requires network access but has high complexity due to the need to obtain the session ID. The fix in djust 1.0.7 binds each SSE session to its owning principal at creation time and rejects cross-principal access attempts, while also implementing per-principal session creation rate limiting. No patch bypass techniques are known, and upgrading or disabling the SSE transport mitigates the issue.

Affected products

  • djust-org djust < 1.0.7

Identifiers

  • CVE-2026-61592
  • GHSA-f795-p5jw-j6g2
  • PYSEC-2026-4043

Timeline

  • 2026-06-22: disclosed: Advisory published by djust-org
  • 2026-06-22: patched: Fixed in djust 1.0.7
  • 2026-09-16: advisory: GitHub Advisory Database reviewed and published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.