djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

🗓️ 01 Oct 2026 16:38:31Reported by Python Packaging AdvisoryType

pypa🔗 github.com👁 5 Views

Session hijack in djust as SSE sessions are keyed solely by a client-chosen session_id.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-61592	17 Sep 202612:31	–	circl
CVE	CVE-2026-61592	16 Sep 202621:53	–	cve
Cvelist	CVE-2026-61592 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)	16 Sep 202621:53	–	cvelist
EUVD	EUVD-2026-81301	16 Sep 202621:53	–	euvd
Github Security Blog	djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)	16 Sep 202621:53	–	github
NVD	CVE-2026-61592	16 Sep 202622:17	–	nvd
OSV	GHSA-F795-P5JW-J6G2 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)	16 Sep 202621:53	–	osv
OSV	PYSEC-2026-4043 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)	1 Oct 202616:38	–	osv
Positive Technologies	PT-2026-94120	16 Sep 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-61592: Session Fixation	16 Sep 202600:00	–	rapid7

Vulners

Node

pypi djustRange0–1.0.7

Source	Link
github	www.github.com/djust-org/djust/security/advisories/GHSA-f795-p5jw-j6g2
github	www.github.com/djust-org/djust
github	www.github.com/djust-org/djust/releases/tag/v1.0.7
pypi	www.pypi.org/project/djust
github	www.github.com/advisories/GHSA-f795-p5jw-j6g2
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-61592

01 Oct 2026 17:10Current

6Medium risk

Vulners AI Score6

CVSS 3.17.4

EPSS0.00388

SSVC