# CVE-2026-55571: djust authentication bypass in LiveView WebSocket mount

Source: https://junglewise.ai/threats/cve-2026-55571-djust-authentication-bypass-in-liveview-websocket-mount  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-55571 · Severity: high · CVSS 8.2 · Published 2026-08-25

djust is a Python web framework that serves interactive user interfaces (LiveViews) over WebSocket connections. When a protected page requires login, the framework was sending a redirect message to the browser but leaving the WebSocket connection open and keeping the view active. An attacker using a raw WebSocket client (not a browser) could ignore the redirect, keep the connection alive, and invoke sensitive operations on the protected page without authenticating—bypassing the framework's access controls entirely.

Technologies: [djust (PyPI)](https://junglewise.ai/threats/technologies/djust). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-55571 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55571 being exploited in the wild.

**How severe is CVE-2026-55571?** High severity, with a CVSS score of 8.2, published 25 August 2026.

**Which products and versions are affected?** djust (PyPI) < 1.0.4, ECOSYSTEM:introduced=0,fixed=1.0.4.

**Is there a fix for CVE-2026-55571?** Yes. djust (PyPI): upgrade to 1.0.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55571 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-55571?** Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- djust (PyPI): upgrade to 1.0.4 or later

  ```sh
  pip install "djust>=1.0.4"
  ```


## Technical details

The vulnerability resides in djust's LiveViewConsumer.handle_mount() method. When a view is gated by login_required, permission_required, or a redirecting on_mount hook, the consumer emits a {"type":"navigate",...} redirect frame and returns, but fails to close the WebSocket or clear the view instance. A browser client obeys the redirect and disconnects naturally, but a raw WebSocket client that ignores the redirect keeps the connection open. Critically, the subsequent handle_event() method does not re-authenticate the user, allowing any unauthenticated client to send {"type":"event",...} frames and invoke @event_handler methods with no authenticated session. This is a full authentication bypass on the live mutation path. Fixed in djust 1.0.4 by closing the socket with code 4403 immediately after emitting the redirect in both the auth-redirect and on_mount-hook-redirect branches. An optional defense-in-depth control (LIVEVIEW_CONFIG['reauth_on_event'] = True) re-verifies authentication on every event for gated views.

## Affected products

- djust-org djust < 1.0.4

## Identifiers

- CVE-2026-55571
- GHSA-xx4j-w367-7247
- PYSEC-2026-3829

## Timeline

- 2026-08-25: disclosed
- 2026-06-13: patched: Fixed in djust 1.0.4 (commit 1ae8aa9, PR #1780)

## References

- [https://github.com/djust-org/djust/security/advisories/GHSA-xx4j-w367-7247](https://github.com/djust-org/djust/security/advisories/GHSA-xx4j-w367-7247)
- [https://github.com/djust-org/djust/pull/1780](https://github.com/djust-org/djust/pull/1780)
- [https://github.com/djust-org/djust/commit/1ae8aa9246b80477de7ddc4d90319a3b267bef04](https://github.com/djust-org/djust/commit/1ae8aa9246b80477de7ddc4d90319a3b267bef04)
- [https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-xx4j-w367-7247](https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-xx4j-w367-7247)

## Related threats

- [djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.](https://junglewise.ai/threats/cve-2026-113731-djust-provides-phoenix-liveview-style-reactive-server-side)
- [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf)
- [djust multiple template-layer cross-site scripting flaws](https://junglewise.ai/threats/djust-six-template-layer-defects-emit-attacker-controlled-markup-54f3f871)
- [djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse)
- [djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor)