{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3adjust_projectdjust/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:djust_project:djust:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-61593"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["djust (\u003c 1.0.7)"],"_cs_severities":["medium"],"_cs_tags":["web-application-security","csrf","sse","vulnerability"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe djust library, prior to version 1.0.7, contains a high-severity Cross-Site Request Forgery (CSRF) vulnerability (CVE-2026-61593) affecting its Server-Sent-Events (SSE) transport implementation. The vulnerability stems from a lack of Origin header validation on SSE endpoints and the use of CSRF-exempted POST endpoints. Because the library allows client-chosen session identifiers and accepts requests with a 'text/plain' content type, an attacker can bypass CORS preflight checks to perform 'simple requests' from a malicious cross-origin page. This enables an attacker to force an authenticated victim's browser to establish an SSE session, mount a LiveView, and execute state-changing event handlers on behalf of the victim. Defenders should prioritize patching to version 1.0.7, which introduces strict Origin validation against 'ALLOWED_HOSTS' and mandates 'application/json' content-type checks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthorized remote attacker to perform state-changing actions within the application context of an authenticated victim. This can lead to unauthorized data modification, account takeover, or the execution of privileged administrative actions. The vulnerability affects all applications using djust prior to version 1.0.7.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the djust package to version 1.0.7 or later to implement required Origin validation and content-type enforcement.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, disable the SSE transport entirely or implement a reverse proxy layer capable of enforcing strict Origin header allowlisting for all traffic directed to the SSE endpoints.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous cross-origin POST requests or SSE stream requests originating from unexpected domains.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-16T19:07:36Z","date_published":"2026-09-16T19:07:36Z","id":"https://feed.craftedsignal.io/briefs/2026-09-djust-csrf/","summary":"The djust library before version 1.0.7 is vulnerable to CSRF via its SSE transport, allowing cross-origin requests to execute state-changing event handlers as an authenticated victim.","title":"Cross-Site Request Forgery Vulnerability in djust SSE Transport","url":"https://feed.craftedsignal.io/briefs/2026-09-djust-csrf/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:djust_project:djust:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}