CVE-2026-61592 describes a session fixation vulnerability in djust prior to version 1.0.7. The SSE sessions were identified solely by a client-chosen session_id, lacking binding to the authenticated user, unlike the WebSocket transport. This allowed an attacker who learns or a victim who leaks a session_id to connect to the message endpoint and dispatch event handlers executing with the victim's identity and state. The issue is resolved in djust 1.0.7 by binding SSE sessions to their owning principal at creation, rejecting cross-principal access, and capping SSE session creation per principal. A workaround is to disable the SSE transport.

An attacker who obtains a valid session_id can impersonate the victim user and execute event handlers with the victim's identity and state, potentially leading to unauthorized access and actions within the application. The vulnerability affects confidentiality and integrity but does not impact availability.

Upgrade to djust version 1.0.7 or later, where the vulnerability is fixed by binding SSE sessions to the authenticated principal and limiting session creation. As a temporary workaround, disable the SSE transport to prevent exploitation.