CVE-2026-61592: djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

SSE sessions were keyed solely by a client-chosen session_id with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns (or a victim who leaks) a session_id could connect to the message endpoint and dispatch event handlers that execute with the victim’s identity and state.