HIGH 8.2 GitHub
CVE-2026-55571
djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch ev
### Impact
djust's `LiveViewConsumer` mounts a `LiveView` over a WebSocket. When a view is gated (`login_required` / `permission_required`, or an `on_mount` hook that returns a redirect) and the connecting user is not authorized, the consumer sent the client a `{"type":"navigate","to":...}` redirect frame and then `return`ed — **without closing the socket and without clearing `self.view_instance`**. Only the `PermissionDenied` branch closed the connection (`close(4403)`).
A real browser obeys
Affected Products
- pip/djust < 1.0.4
References
- https://github.com/advisories/GHSA-xx4j-w367-7247
- https://github.com/djust-org/djust/security/advisories/GHSA-xx4j-w367-7247
- https://github.com/djust-org/djust/pull/1780
- https://github.com/djust-org/djust/commit/1ae8aa9246b80477de7ddc4d90319a3b267bef04
This high severity vulnerability with a CVSS score of 8.2 was published on 2026-08-25 via GitHub. Affected: pip/djust < 1.0.4.
vulnfeed aggregates 11954 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.