Cross-Origin Vulnerability in Djust Affecting SSE Endpoints

CVE-2026-61593

What is CVE-2026-61593?

The Djust Framework prior to version 1.0.7 contains a cross-origin vulnerability in its Server-Sent Events (SSE) endpoints. The SS client-to-server POST endpoints are set to @csrf_exempt, while the SSE GET stream endpoint lacks an Origin check, allowing malicious actors to exploit this weakness. An attacker can craft a request from a cross-origin page to access a victim's cookie-authenticated SSE session. This could lead the victim's browser to inadvertently send state-changing requests as if they were the authenticated user. Version 1.0.7 mitigates these risks by enforcing strict validation on the request Origin against ALLOWED_HOSTS, thereby rejecting cross-origin requests. Furthermore, POST requests now require the Content-Type: application/json, preventing the bypass that existed with text/plain simple requests. Users are advised to upgrade to version 1.0.7 or implement alternative protective measures such as disabling SSE transport or employing a proxy with an Origin allowlist.

References