SSE sessions were keyed solely by a client-chosen session id with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a session id could connect to the message endpoint and dispatch event handlers that execute with the victim's identity and state.

Fixed in djust 1.0.7. Each SSE session is bound to its owning principal at creation and cross-principal access is rejected; SSE session creation is additionally capped per principal.

Disable the SSE transport short of upgrading.