CVE-2026-61593

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7

Description The SSE client-to-server POST endpoints are marked as @csrf exempt and the SSE GET stream endpoint lacks an Origin check. This allows a cross-origin page to manipulate a session authenticated by victim cookies by forcing the browser to GET the stream URL and POST to the message endpoint using credentials: include to trigger state-changing event handlers. The session id variable in the URL is client-chosen and only validated for UUID format, meaning it does not function as a CSRF token. Additionally, sending a JSON body as text/plain constitutes a CORS simple request, bypassing preflight checks.

Recommendations Update to version 1.0.7. Disable the SSE transport. Use a proxy that enforces an Origin allowlist to front the SSE endpoints.