CVE-2026-55571: djust authentication bypass in LiveView WebSocket mount

CVE-2026-55571 · Severity: high · CVSS 8.2 · Published 2026-08-25

djust is a Python web framework that serves interactive user interfaces (LiveViews) over WebSocket connections. When a protected page requires login, the framework was sending a redirect message to the browser but leaving the WebSocket connection open and keeping the view active. An attacker using a raw WebSocket client (not a browser) could ignore the redirect, keep the connection alive, and invoke sensitive operations on the protected page without authenticating—bypassing the framework's access controls entirely.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-55571 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-55571 being exploited in the wild.
How severe is CVE-2026-55571?
High severity, with a CVSS score of 8.2, published 25 August 2026.
Which products and versions are affected?
djust (PyPI) < 1.0.4, ECOSYSTEM:introduced=0,fixed=1.0.4.
Is there a fix for CVE-2026-55571?
Yes. djust (PyPI): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55571 attacked?
It is attacked over the network.
Am I affected by CVE-2026-55571?
Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djust (PyPI): upgrade to 1.0.4 or later
    pip install "djust>=1.0.4"

Technical details

The vulnerability resides in djust's LiveViewConsumer.handle_mount() method. When a view is gated by login_required, permission_required, or a redirecting on_mount hook, the consumer emits a {"type":"navigate",...} redirect frame and returns, but fails to close the WebSocket or clear the view instance. A browser client obeys the redirect and disconnects naturally, but a raw WebSocket client that ignores the redirect keeps the connection open. Critically, the subsequent handle_event() method does not re-authenticate the user, allowing any unauthenticated client to send {"type":"event",...} frames and invoke @event_handler methods with no authenticated session. This is a full authentication bypass on the live mutation path. Fixed in djust 1.0.4 by closing the socket with code 4403 immediately after emitting the redirect in both the auth-redirect and on_mount-hook-redirect branches. An optional defense-in-depth control (LIVEVIEW_CONFIG['reauth_on_event'] = True) re-verifies authentication on every event for gated views.

Affected products

  • djust-org djust < 1.0.4

Identifiers

  • CVE-2026-55571
  • GHSA-xx4j-w367-7247
  • PYSEC-2026-3829

Timeline

  • 2026-08-25: disclosed
  • 2026-06-13: patched: Fixed in djust 1.0.4 (commit 1ae8aa9, PR #1780)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.