CVE-2026-61593 Details

A cross-origin cross-site request forgery vulnerability has been identified in Djust versions prior to 1.0.7. The issue arises because the server-sent events (SSE) client-to-server POST endpoints are exempt from CSRF protection, and the SSE GET stream endpoint lacks an Origin check. This allows a cross-origin page to manipulate a victim's SSE session, authenticated with cookies. By forcing the victim's browser to access the stream URL, which activates a LiveView session on their behalf, and sending a POST request to the message endpoint with included credentials, state-changing event handlers can be triggered as if they were the victim. The vulnerability is exacerbated by the fact that the session ID is user-defined and only validated for UUID format, making it ineffective as a CSRF token. Additionally, a JSON body transmitted as text/plain qualifies as a CORS simple request, bypassing preflight requirements.

Users can upgrade to Djust version 1.0.7, where this vulnerability is fixed. In this version, all SSE endpoints validate the request Origin against ALLOWED_HOSTS, rejecting cross-origin requests with a 403 status. The POST endpoints also require a Content-Type of application/json, closing the text/plain simple-request bypass. As an alternative, the SSE transport can be disabled or fronted with a proxy that enforces an Origin allowlist.