CVE-2026-55571

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"type":"navigate","to":...}` frame when login_required, permission_required, or a redirecting on_mount hook denies a LiveView mount, but returns without closing the WebSocket or clearing self.view_instance. A browser follows the redirect, but a raw WebSocket client can ignore it and retain the mounted socket. Because LiveViewConsumer.handle_event does not recheck authentication or authorization, the client can send `{"type":"event",...}` frames that invoke @event_handler methods without an authenticated session, including through handle_live_redirect_mount, enabling unauthorized sensitive reads or mutations. This issue is fixed in version 1.0.4.

• CWE-285
• CWE-306

• https://github.com/djust-org/djust/commit/1ae8aa9246b80477de7ddc4d90319a3b267bef04
• https://github.com/djust-org/djust/pull/1780
• https://github.com/djust-org/djust/releases/tag/v1.0.4
• https://github.com/djust-org/djust/security/advisories/GHSA-xx4j-w367-7247
• https://github.com/djust-org/djust/security/advisories/GHSA-xx4j-w367-7247

Published

Aug 25, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-55566Yamcs is a mission control framework. Prior to 5.12.8 and 5.…4.3
• CVE-2026-55567BleachBit cleans files to free disk space and to maintain pr…7.8
• CVE-2026-55568Guzzle is an extensible PHP HTTP client. Prior to 7.12.1, in…5.9
• CVE-2026-55569aqua is a declarative command-line version manager written i…6.6
• CVE-2026-5557A vulnerability was detected in badlogic pi-mono up to 0.58.…6.3
• CVE-2026-55570SiYuan is an open-source personal knowledge management syste…9
• CVE-2026-55574vLLM is a high-throughput and memory-efficient inference and…7.5
• CVE-2026-55575LiquidJS is a Shopify / GitHub Pages compatible template eng…8.2
• CVE-2026-55576MaaAssistantArknights is a one-click tool for daily Arknight…8.8
• CVE-2026-55577ImageMagick is free and open-source software used for editin…5.9
• CVE-2026-55578Pheditor is a single-file editor and file manager written in…8.8
• CVE-2026-55579Pheditor is a single-file editor and file manager written in…9.8