CVE-2026-61593

8.1 HIGHpublic exploit available

Published 2026-09-16 · Updated 2026-09-16

AI risk analysis

Summary: The flaw in djust allows cross-origin requests to drive a victim-cookie-authenticated session, enabling state-changing events to be triggered as the victim.
Exploitability: Exploitation requires a cross-origin page to force the victim's browser to GET the stream URL and POST to the message endpoint with credentials: include, making it moderately hard to exploit.
Blast radius: If exploited, the real-world impact could be significant, as it allows state changes to be made as the victim without their knowledge.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to version 1.0.7 or later.

webauth-bypassreactive-renderingsse

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are `@csrf_exempt` and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with `credentials: include` to fire state-changing event handlers as the victim. The URL `session_id` is client-chosen (validated only for UUID *format*), so it is not a CSRF token, and a JSON body sent as `text/plain` is a CORS simple request with no preflight. The issue is fixed in 1.0.7. All three SSE endpoints validate the request `Origin` against `ALLOWED_HOSTS` (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require `Content-Type: application/json` (415 otherwise), closing the `text/plain` simple-request bypass. As a workaround, disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weaknesses

CWE-352

Public exploit & PoC references

References

Data: NVD (public domain). Analysis: local $0 model. Defensive use only.