CVE-2026-61592

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7

Description SSE sessions are keyed solely by a client-chosen session id without binding to the authenticated user. This allows an attacker who obtains a session id to connect to the message endpoint and dispatch event handlers that execute using the victim's identity and state. SSE (Server-Sent Events) is a standard allowing servers to push real-time updates to web pages over a single HTTP connection.

Recommendations Update to version 1.0.7. Disable the SSE transport as a temporary workaround.