Read the docs
TI-2026-44120 Aliases CVE-2026-61592GHSA-f795-p5jw-j6g2

Session fixation in djust-org djust

Priority LOW 35CWE-384Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-384 and CWE-639.

Summary

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen `session_id` with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a `session_id` could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. This is fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal. As a workaround, disable the SSE transport.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00388 33rd percentileScored 2026-11-07
Fix Fixed djust (djust-org): 1.0.7djust (PyPI): 1.0.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
djust-orgdjustbefore 1.0.71.0.7Patch availableCNA
—djust (PyPI)before 1.0.71.0.7Patch availableGHSA-f795-p5jw-j6g2
  • djust Vendordjust-org Affected before 1.0.7 Fixed in 1.0.7 Patch available CNA
  • djust (PyPI) Vendor— Affected before 1.0.7 Fixed in 1.0.7 Patch available GHSA-f795-p5jw-j6g2

Remediation

  • Fix · CNA djust (djust-org) Fixed in 1.0.7
  • Fix · GHSA-f795-p5jw-j6g2 djust (PyPI) Fixed in 1.0.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61592
  2. 2026-10-03 Alias added: GHSA-f795-p5jw-j6g2

References

Other 3

  • TI-2026-40112 Improper authorization in djust-org djust CVSS 3.1HIGH 8.2
  • TI-2026-78534 Arbitrary file read in djust find_handlers_for_template MCP tool CVSS 3.1LOW 3.3
  • TI-2026-44127 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path CVSS 4.0HIGH 8.8
  • TI-2026-44122 djust has an authorization bypass on the WebSocket/SSE mount path CVSS 3.1CRITICAL 9.1
  • TI-2026-44121 Cross-site request forgery in djust-org djust CVSS 3.1HIGH 8.1
  • TI-2026-44119 djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection) CVSS 3.1HIGH 8.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences