djust CVE-2026-61593

Requires djust < 1.0.7 with the SSE transport in use (the affected client→server POST endpoints are @csrf_exempt and the GET stream endpoint lacks an Origin check). The victim must have an active cookie-authenticated djust session AND must be lured to visit an attacker-controlled page (UI:R). Exploitation leverages that the URL session_id is client-chosen and validated only for UUID format (not a CSRF token) and that a JSON body sent as Content-Type: text/plain is a CORS simple request needing no preflight. Limiting factors: no attacker authentication needed, but success depends on victim interaction, an existing authenticated victim session, and the SSE transport being enabled and not fronted by an Origin-enforcing proxy. Fully mitigated in 1.0.7 (Origin validated against ALLOWED_HOSTS → 403; POST requires Content-Type: application/json → 415).

This is a genuine, well-characterized CSRF (CWE-352) on djust's Server-Sent-Events transport. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N = 8.1) is internally consistent for a CSRF: network vector, low complexity, no attacker privileges (the attack rides the victim's cookie session), but requiring user interaction (UI:R) because the victim must be lured to an attacker-controlled page. No EPSS score, no CISA KEV listing, and no public POC are present in the intelligence, so exploitation status is 'no public exploit identified at time of analysis' - this is a disclosed-and-patched advisory, not an actively-exploited threat. The one signal I would contest is C:H: this is a classic forgery where the cross-origin attacker forces state-changing actions but, under the same-origin policy, cannot read the SSE response stream back (cross-origin EventSource/fetch without CORS grants no read access). The true impact is integrity (firing state-changing event handlers and mounting a LiveView as the victim), so I assess confidentiality lower than the vendor. Net: a real, medium-to-high vulnerability worth patching, but it is a request-forgery requiring victim interaction and an authenticated victim session, not a wormable unauthenticated RCE.

An attacker hosts a malicious web page and lures a logged-in djust user (with an active cookie session) to visit it. The page silently forces the victim's browser to GET the SSE stream URL - creating and mounting a LiveView as the victim - then issues a fetch POST with credentials:include and a JSON body sent as text/plain (a CORS simple request with no preflight) to the message endpoint, firing state-changing event handlers under the victim's identity. No public exploit code is identified, but the technique is straightforward and fully described in the advisory.