Skip to content
Threat Feed
Subscribe

Product

Djust (< 1.0.7)

2 briefs RSS
critical advisory

Multi-tenant Isolation Bypass in djust via WebSocket/SSE

A vulnerability in djust caused multi-tenant isolation to fail open on WebSocket and SSE paths, allowing unauthorized cross-tenant data disclosure due to improper tenant context propagation.

djust +1 web-application mass-assignment cve-2026-61598 remote-code-execution information-disclosure cve-2026-61590 idor broken-access-control +5
6t 1c updated
medium advisory

Cross-Site Request Forgery Vulnerability in djust SSE Transport

The djust library before version 1.0.7 is vulnerable to CSRF via its SSE transport, allowing cross-origin requests to execute state-changing event handlers as an authenticated victim.

djust web-application-security csrf sse vulnerability
1r 1c