Executive brief
djust is a Python web framework that serves interactive user interfaces (LiveViews) over WebSocket connections. When a protected page requires login, the framework was sending a redirect message to the browser but leaving the WebSocket connection open and keeping the view active. An attacker using a raw WebSocket client (not a browser) could ignore the redirect, keep the connection alive, and invoke sensitive operations on the protected page without authenticating—bypassing the framework's access controls entirely.
Technical details
The vulnerability resides in djust's LiveViewConsumer.handle_mount() method. When a view is gated by login_required, permission_required, or a redirecting on_mount hook, the consumer emits a {"type":"navigate",...} redirect frame and returns, but fails to close the WebSocket or clear the view instance. A browser client obeys the redirect and disconnects naturally, but a raw WebSocket client that ignores the redirect keeps the connection open. Critically, the subsequent handle_event() method does not re-authenticate the user, allowing any unauthenticated client to send {"type":"event",...} frames and invoke @event_handler methods with no authenticated session. This is a full authentication bypass on the live mutation path. Fixed in djust 1.0.4 by closing the socket with code 4403 immediately after emitting the redirect in both the auth-redirect and on_mount-hook-redirect branches. An optional defense-in-depth control (LIVEVIEW_CONFIG['reauth_on_event'] = True) re-verifies authentication on every event for gated views.
Affected products
- djust-org djust < 1.0.4
Timeline
- 2026-08-25: disclosed
- 2026-06-13: patched: Fixed in djust 1.0.4 (commit 1ae8aa9, PR #1780)