CVE-2026-61593 Overview
CVE-2026-61593 is a Cross-Site Request Forgery [CWE-352] vulnerability in djust, a library that provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Versions prior to 1.0.7 expose Server-Sent Events (SSE) endpoints without Origin validation or CSRF protection. A cross-origin page can drive a victim's authenticated SSE session, mount a LiveView as the victim, and trigger state-changing event handlers using the victim's cookies. The maintainers released version 1.0.7 to close the flaw.
Critical Impact
An attacker-controlled page can execute LiveView event handlers as an authenticated victim, compromising confidentiality and integrity of user sessions.
Affected Products
- djust versions prior to 1.0.7
- Django applications using the djust SSE transport
- Deployments without an Origin-enforcing proxy in front of djust
Discovery Timeline
- 2026-09-16 - CVE-2026-61593 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-61593
Vulnerability Analysis
The vulnerability affects three SSE endpoints exposed by djust for reactive server-side rendering. The client-to-server POST endpoints are decorated with @csrf_exempt, removing Django's default CSRF protections. The SSE GET stream endpoint performs no Origin check. A cross-origin page can therefore instruct the victim's browser to open the SSE stream URL, which creates and mounts a LiveView using the victim's session cookies.
The URL session_id parameter is chosen by the client and validated only for UUID format. It does not function as a CSRF token because an attacker can generate a valid UUID and reuse it across the GET and POST requests. Once the LiveView is mounted, the attacker's page issues POST requests to the message endpoint with credentials: include, invoking event handlers in the victim's authenticated context.
Root Cause
The root cause is the combination of @csrf_exempt on state-changing POST endpoints and the absence of Origin validation on all SSE endpoints. Sending the JSON payload with Content-Type: text/plain qualifies as a CORS simple request, so browsers do not issue a preflight. The server accepts the body without any cross-origin gate.
Attack Vector
An attacker hosts a malicious page and lures an authenticated victim to visit it. The page issues a GET to the djust SSE stream URL using an attacker-chosen UUID session_id. The victim's browser attaches session cookies, and djust mounts a LiveView bound to the victim's identity. The page then POSTs a JSON message body typed as text/plain to the djust message endpoint with credentials: include, invoking arbitrary event handlers as the victim. Refer to the GitHub Security Advisory GHSA-pg97-jvmf-qfvc for further technical details.
Detection Methods for CVE-2026-61593
Indicators of Compromise
- SSE stream GET requests where the Origin or Referer header does not match an allowed application host.
- POST requests to djust message endpoints carrying Content-Type: text/plain with a JSON body.
- Unexpected LiveView mounts tied to session cookies immediately followed by state-changing event handler invocations.
Detection Strategies
- Inspect web server or reverse proxy logs for requests to djust SSE routes with foreign Origin values.
- Correlate SSE session creation events with subsequent POSTs that occur without a prior first-party page load.
- Add server-side logging around djust event handler execution to record request Origin and Content-Type for later review.
Monitoring Recommendations
- Alert on requests to the djust SSE endpoints returning HTTP 403 after upgrading to 1.0.7, which indicate rejected cross-origin attempts.
- Monitor for spikes in mounted LiveView sessions that do not correlate with first-party traffic patterns.
- Track authentication-sensitive operations initiated through LiveView handlers and flag those without a matching user interaction trail.
How to Mitigate CVE-2026-61593
Immediate Actions Required
- Upgrade djust to version 1.0.7 or later across all environments running the SSE transport.
- Audit application logs for prior cross-origin requests to djust SSE endpoints and investigate suspicious session activity.
- Review LiveView event handlers for state-changing operations and add server-side authorization checks where absent.
Patch Information
Version 1.0.7 validates the request Origin header against ALLOWED_HOSTS on all three SSE endpoints, mirroring djust's WebSocket cross-site WebSocket hijacking (CSWSH) defense, and rejects cross-origin requests with HTTP 403. The POST endpoints additionally require Content-Type: application/json and return HTTP 415 otherwise, closing the text/plain simple-request bypass. See the GitHub Release v1.0.7 for the full changelog.
Workarounds
- Disable the SSE transport if the deployment can operate without it.
- Front djust with a reverse proxy that enforces an Origin allowlist and blocks non-JSON Content-Types on POST endpoints.
- Restrict application cookies with SameSite=Lax or SameSite=Strict to reduce the attack surface for cross-origin credentialed requests.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
