CVE-2026-61594: Authorization Bypass on WebSocket and SSE Mount Paths in djust

Vulnerability ID: CVE-2026-61594
CVSS Score: 9.1
Published: 2026-09-16

An authorization bypass vulnerability exists in the djust framework (djust-org/djust) prior to version 1.0.7. The framework fails to enforce standard Django view-level authorization mechanisms, such as AccessMixins or dispatch decorators, when mounting reactive views over stateful transport layers (WebSockets and Server-Sent Events). Unauthenticated or low-privileged attackers can establish persistent connections to mount arbitrary protected views and execute state-changing event handlers.

TL;DR

Unauthenticated remote attackers can bypass Django view-level access controls to mount protected reactive views and execute state-changing event handlers via direct WebSocket or Server-Sent Events (SSE) connections.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-862
• Attack Vector: Network (AV:N)
• CVSS Score: 9.1 (Critical)
• EPSS Score: Not listed
• Impact: High (Confidentiality & Integrity)
• Exploit Status: PoC / Verifiable
• KEV Status: Not listed

Affected Systems

• djust-org/djust
• djust: < 1.0.7 (Fixed in: 1.0.7)

Mitigation Strategies

• Upgrade to djust version 1.0.7 or later.
• Use djust-native class-level declarative authorization attributes instead of HTTP-specific mixins or decorators.
• Run Django system checks to identify vulnerable LiveView configurations.

Remediation Steps:

1. Upgrade djust to version 1.0.7 via pip/poetry: pip install djust>=1.0.7
2. Scan the codebase for any LiveView classes using standard Django LoginRequiredMixin, PermissionRequiredMixin, or custom overridden dispatch methods.
3. Refactor identified views to use native declarative attributes like login_required = True or native djust permission gates.
4. Execute python manage.py check to verify there are no active system check violations (specifically djust.S004).

References

• GitHub Security Advisory GHSA-xhhm-f6hp-2qwj
• djust Release v1.0.7
• djust Compare v1.0.6...v1.0.7
• CVE-2026-61594 CVE Record

Read the full report for CVE-2026-61594 on our website for more details including interactive diagrams and full exploit analysis.