Executive brief
djust is a Django framework for building real-time web applications using WebSocket and Server-Sent Events (SSE). The library failed to enforce view-level authorization checks (such as login requirements or permission restrictions) over WebSocket connections, even though these checks were correctly enforced over HTTP. An unauthenticated attacker could open a WebSocket connection and gain unauthorized access to protected views, including administrative functions like creating, reading, updating, or deleting data, potentially exposing or modifying sensitive business information.
Technical details
The vulnerability is an authorization bypass in djust's WebSocket/SSE transport layer. The root cause is that WebSocket mount operations use `check_view_auth` for authorization instead of Django's standard `View.dispatch()` chain, which means common Django authorization mechanisms like `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, method decorators (`@login_required`), and custom `dispatch()` overrides are silently bypassed over WebSocket—though they are correctly enforced on the initial HTTP GET request. The attack vector is network-based with no authentication required and no user interaction necessary; an anonymous or under-privileged client can open a WebSocket connection and mount protected views, dispatching their handlers with full access. This affects all djust views using standard Django authorization patterns prior to version 1.0.7. The fix (released in djust 1.0.7) extends `check_view_auth` to honor Django's `AccessMixin` family on all transports, adds a system check (S004) to detect unsafe auth patterns at startup, and enforces `login_required` and staff-gate checks in the admin extension.
Affected products
- djust-org djust < 1.0.7
Timeline
- 2026-06-22: disclosed
- 2026-06-22: patched: Fixed in djust 1.0.7
- 2026-09-16: advisory