Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-61594— djust has an authorization bypass on the WebSocket/SSE mount path

Quick assessment

Affected
djust-org djust
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

djust 为 Django 提供类似 Phoenix LiveView 的响应式服务端渲染，并借助 Rust 获得性能提升。在 1.0.7 版本之前，live（WebSocket）传输层通过 对视图挂载进行授权，而非通过 Django 的 调用链。因此，标准的 Django 授权机制——包括 、 、 、 以及自定义的 守卫——和 djust 管理后台扩展中的 staff 门槛（仅在 HTTP 包装器中生效）会在初始 HTTP GET 请求中生效，但在承载所有事件和状态流动的 WebSocket 连接中被静默绕过。

CVSS 9.1 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61594

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
djust has an authorization bypass on the WebSocket/SSE mount path
Source: CVE Program / CVE List V5
Vulnerability Description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) transport authorizes a mount via `check_view_auth`, not Django's `View.dispatch()` chain. As a result, standard Django authorization — `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, `@method_decorator(login_required, name="dispatch")`, and custom `dispatch()` guards — and the djust admin extension's staff gate (applied only in the HTTP `as_view` wrapper) were enforced on the initial HTTP GET but silently bypassed over WebSocket, where all events and state flow. An anonymous or under-privileged client could open a WebSocket and mount such a view — including admin list/create/change/delete — and dispatch its handlers. This is fixed in djust 1.0.7. `check_view_auth` now honors the Django `AccessMixin` family on every transport; a new system check S004 fails loud at startup on auth patterns the runtime cannot safely replay (decorator/overridden-`dispatch` forms); and the admin base mixin declares `login_required = True` + an active-staff `check_permissions` gate. As a workaround, gate views using djust's `login_required` / `permission_required` / `check_permissions` attributes (honored on all transports) rather than HTTP-only mixins/decorators.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
djust-org djust < 1.0.7 -

II. Public POCs for CVE-2026-61594

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61594

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-61594 (1)

Vendor Pages for CVE-2026-61594 (1)

Same Patch Batch · djust-org · 2026-09-16 · 12 CVEs total

CVE-2026-61599 8.8 HIGH djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path
CVE-2026-61593 8.1 HIGH djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin p
CVE-2026-61591 8.1 HIGH djust: Unsigned client state snapshot is restored as trusted view state (privilege escalat
CVE-2026-61595 7.7 HIGH djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenan
CVE-2026-61590 7.4 HIGH djust's observability endpoints are network-exposed: the localhost gate is an opt-in middl
CVE-2026-61592 7.4 HIGH djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id
CVE-2026-61598 7.1 HIGH Client mass-assignment of arbitrary view attributes via the default dj-model update_model
CVE-2026-61596 7.1 HIGH djust has broken object-level access control (IDOR)
CVE-2026-61588 6.5 MEDIUM djust's Django model serialization has no sensitive-field denylist: password hashes, privi
CVE-2026-61589 6.3 MEDIUM djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdoma
CVE-2026-61597 5.1 MEDIUM djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component tem

IV. Related Vulnerabilities

Same product: djust
Same vendor: djust-org
Same weakness: CWE-306

V. Comments for CVE-2026-61594

No comments yet

Leave a comment