PYSEC-2026-4044

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/djust/PYSEC-2026-4044.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-4044
Aliases
Published
2026-10-01T16:38:31Z
Modified
2026-10-01T17:45:02Z
Severity
  • 8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N CVSS Calculator
Summary
djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session
Details

Impact

The SSE client→server POST endpoints are @csrf_exempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL (which creates and mounts a LiveView as the victim) and POST to the message endpoint with credentials: include to fire state-changing event handlers as the victim. The URL session_id is client-chosen (validated only for UUID format), so it is not a CSRF token, and a JSON body sent as text/plain is a CORS simple request with no preflight.

Patches

Fixed in djust 1.0.7. All three SSE endpoints validate the request Origin against ALLOWED_HOSTS (mirroring the WebSocket CSWSH defense) and reject cross-origin requests with 403; the POST endpoints additionally require Content-Type: application/json (415 otherwise), closing the text/plain simple-request bypass.

Workarounds

Disable the SSE transport, or front it with a proxy that enforces an Origin allowlist.

References

Affected packages

PyPI / djust

Package

Name
djust
View open source insights on deps.dev
Purl
pkg:pypi/djust

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.0.7

Affected versions

0.*
0.1.0
0.1.2
0.1.3
0.1.4
0.1.5
0.1.6
0.1.7
0.1.8
0.1.9
0.2.0
0.2.1
0.2.2
0.3.0
0.3.1
0.3.2
0.3.4
0.3.5
0.3.6
0.3.7
0.3.8
0.4.0
0.4.1
0.4.2
0.4.3
0.4.4
0.9.0
0.9.1
0.9.2
0.9.4
0.9.5
0.9.6
0.9.7
1.*
1.0.0rc11
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/djust/PYSEC-2026-4044.yaml"