CVE-2026-61594: djust authorization bypass on WebSocket/SSE mount path

CVE-2026-61594 · Severity: critical · CVSS 9.1 · Published 2026-09-16

djust is a Django framework for building real-time web applications using WebSocket and Server-Sent Events (SSE). The library failed to enforce view-level authorization checks (such as login requirements or permission restrictions) over WebSocket connections, even though these checks were correctly enforced over HTTP. An unauthenticated attacker could open a WebSocket connection and gain unauthorized access to protected views, including administrative functions like creating, reading, updating, or deleting data, potentially exposing or modifying sensitive business information.

Technologies: djust (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-61594 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61594 being exploited in the wild.
How severe is CVE-2026-61594?
Critical severity, with a CVSS score of 9.1, published 16 September 2026.
Which products and versions are affected?
djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.
Is there a fix for CVE-2026-61594?
Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61594 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61594?
Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • djust (PyPI): upgrade to 1.0.7 or later
    pip install "djust>=1.0.7"

Technical details

The vulnerability is an authorization bypass in djust's WebSocket/SSE transport layer. The root cause is that WebSocket mount operations use `check_view_auth` for authorization instead of Django's standard `View.dispatch()` chain, which means common Django authorization mechanisms like `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, method decorators (`@login_required`), and custom `dispatch()` overrides are silently bypassed over WebSocket—though they are correctly enforced on the initial HTTP GET request. The attack vector is network-based with no authentication required and no user interaction necessary; an anonymous or under-privileged client can open a WebSocket connection and mount protected views, dispatching their handlers with full access. This affects all djust views using standard Django authorization patterns prior to version 1.0.7. The fix (released in djust 1.0.7) extends `check_view_auth` to honor Django's `AccessMixin` family on all transports, adds a system check (S004) to detect unsafe auth patterns at startup, and enforces `login_required` and staff-gate checks in the admin extension.

Affected products

  • djust-org djust < 1.0.7

Identifiers

  • CVE-2026-61594
  • GHSA-xhhm-f6hp-2qwj
  • PYSEC-2026-4047

Timeline

  • 2026-06-22: disclosed
  • 2026-06-22: patched: Fixed in djust 1.0.7
  • 2026-09-16: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.