CVE-2026-55571
Received Received - Intake

Authentication Bypass in djust Django LiveView

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"type":"navigate","to":...}` frame when login_required, permission_required, or a redirecting on_mount hook denies a LiveView mount, but returns without closing the WebSocket or clearing self.view_instance. A browser follows the redirect, but a raw WebSocket client can ignore it and retain the mounted socket. Because LiveViewConsumer.handle_event does not recheck authentication or authorization, the client can send `{"type":"event",...}` frames that invoke @event_handler methods without an authenticated session, including through handle_live_redirect_mount, enabling unauthorized sensitive reads or mutations. This issue is fixed in version 1.0.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-55571
EUVD
EUVD-2026-65600

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
djust djust 1.0.4
djust liveviewconsumer 1.0.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in the djust framework affecting versions before 1.0.4. When a LiveView protected by login_required, permission_required, or an on_mount redirect hook rejects an unauthorized user, the system sends a redirect frame but fails to close the WebSocket connection. This allows unauthenticated raw WebSocket clients to bypass authentication and invoke event-handler methods on the gated view, potentially performing unauthorized sensitive reads or mutations.

Detection Guidance

Detecting this vulnerability requires checking if your djust version is below 1.0.4 and monitoring WebSocket connections for improper socket closure during authentication redirects. Inspect WebSocket logs for open connections after redirect frames without proper closure code 4403.

Impact Analysis

Unauthenticated attackers could exploit this to send unauthorized event messages to sensitive handlers, potentially reading or modifying data without proper authentication. This requires knowledge of the view path and event names and uses a non-browser WebSocket client. The impact includes unauthorized data access or modifications.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate GDPR's data protection principles (Article 5) and HIPAA's security rule (45 CFR 164.308) requiring access controls and integrity measures. Unauthorized mutations or reads of sensitive data via unauthenticated WebSocket events could result in non-compliance with these regulations.

Mitigation Strategies

Upgrade djust to version 1.0.4 or later immediately. If upgrading is not possible, implement manual authentication checks in each event handler for gated LiveViews. Ensure WebSocket connections are properly closed with code 4403 during authentication redirects.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55571. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart