CVE-2026-61592 Overview
CVE-2026-61592 is a session fixation vulnerability [CWE-384] in djust, a library that provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Versions prior to 1.0.7 key Server-Sent Events (SSE) sessions solely by a client-chosen session_id without binding the session to the authenticated user. An attacker who learns or is leaked a victim's session_id can connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state. The WebSocket transport enforces principal binding, but SSE dropped that control.
Critical Impact
Attackers who obtain a valid session_id can hijack SSE sessions and execute event handlers as the victim, resulting in confidentiality and integrity compromise.
Affected Products
- djust versions prior to 1.0.7
- Django applications using djust SSE transport
- Deployments relying on djust reactive server-side rendering
Discovery Timeline
- 2026-09-16 - CVE-2026-61592 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-61592
Vulnerability Analysis
The djust library exposes two transports for reactive server-side rendering: WebSocket and Server-Sent Events. The WebSocket transport binds each session to the authenticated principal at connection time and rejects cross-principal access. The SSE transport, however, identifies sessions using only a client-supplied session_id string.
When a client connects to the SSE message endpoint, djust locates the session using the supplied session_id and dispatches event handlers under that session's context. No verification confirms that the calling principal matches the principal that originally created the session. Any request presenting a known session_id inherits that session's identity, permissions, and application state.
This vulnerability enables session hijacking whenever a session_id leaks through logs, referrer headers, proxy caches, browser history, error reports, or predictable generation.
Root Cause
The root cause is the omission of principal-to-session binding on the SSE transport. Session identifiers are treated as sufficient authenticators, violating the principle that session tokens must be bound to authenticated identity. This aligns with [CWE-384: Session Fixation], where an attacker can force or reuse a session identifier that the application accepts without re-authentication.
Attack Vector
An attacker who obtains a victim's session_id connects to the djust SSE message endpoint and dispatches arbitrary event handlers. The handlers execute with the victim's authenticated identity and current UI state. Exploitation requires knowledge of a valid session_id, which raises attack complexity but does not require prior authentication or user interaction on the attacker side.
See the GitHub Security Advisory GHSA-f795-p5jw-j6g2 for technical details published by the project maintainers.
Detection Methods for CVE-2026-61592
Indicators of Compromise
- SSE message endpoint requests where the source IP or user-agent differs from the IP or user-agent that established the session.
- Multiple concurrent connections against the same session_id from distinct network origins.
- Event handler invocations that do not correspond to prior legitimate UI interactions from the session owner.
Detection Strategies
- Correlate SSE session creation events with subsequent message endpoint requests and alert on principal mismatches.
- Log session_id usage alongside authenticated user identity and flag divergence between session creator and session user.
- Baseline per-user SSE session counts and alert on unusual creation volumes prior to applying the 1.0.7 per-principal cap.
Monitoring Recommendations
- Enable verbose access logging on djust SSE endpoints and forward logs to a centralized analytics platform.
- Monitor referrer, proxy, and error-reporting pipelines for accidental exposure of session_id values.
- Track authentication anomalies where actions attributed to a user originate from unexpected client contexts.
How to Mitigate CVE-2026-61592
Immediate Actions Required
- Upgrade djust to version 1.0.7 or later, which binds each SSE session to its owning principal at creation and rejects cross-principal access.
- Invalidate existing SSE sessions after upgrade to force re-establishment under the new binding logic.
- Audit logs, proxies, and error trackers for historical exposure of session_id values and rotate affected user sessions.
Patch Information
The fix is available in djust 1.0.7. The release binds each SSE session to its owning principal at creation, rejects cross-principal access to the message endpoint, and caps SSE session creation per principal. See the GitHub Release v1.0.7 for the full changelog.
Workarounds
- Disable the SSE transport and rely exclusively on the WebSocket transport, which already enforces principal binding.
- Restrict access to the djust SSE message endpoint at the reverse proxy layer until the patch is applied.
- Enforce strict transport security and short-lived session identifiers to reduce the window for session_id leakage.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
