# CVE-2026-61594: djust authorization bypass on WebSocket/SSE mount path

Source: https://junglewise.ai/threats/cve-2026-61594-djust-authorization-bypass-on-websocket-sse-mount-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61594 · Severity: critical · CVSS 9.1 · Published 2026-09-16

djust is a Django framework for building real-time web applications using WebSocket and Server-Sent Events (SSE). The library failed to enforce view-level authorization checks (such as login requirements or permission restrictions) over WebSocket connections, even though these checks were correctly enforced over HTTP. An unauthenticated attacker could open a WebSocket connection and gain unauthorized access to protected views, including administrative functions like creating, reading, updating, or deleting data, potentially exposing or modifying sensitive business information.

Technologies: [djust (PyPI)](https://junglewise.ai/threats/technologies/djust). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-61594 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61594 being exploited in the wild.

**How severe is CVE-2026-61594?** Critical severity, with a CVSS score of 9.1, published 16 September 2026.

**Which products and versions are affected?** djust (PyPI) < 1.0.7, ECOSYSTEM:introduced=0,fixed=1.0.7.

**Is there a fix for CVE-2026-61594?** Yes. djust (PyPI): upgrade to 1.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61594 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61594?** Check whether you run djust (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- djust (PyPI): upgrade to 1.0.7 or later

  ```sh
  pip install "djust>=1.0.7"
  ```


## Technical details

The vulnerability is an authorization bypass in djust's WebSocket/SSE transport layer. The root cause is that WebSocket mount operations use `check_view_auth` for authorization instead of Django's standard `View.dispatch()` chain, which means common Django authorization mechanisms like `LoginRequiredMixin`, `PermissionRequiredMixin`, `UserPassesTestMixin`, method decorators (`@login_required`), and custom `dispatch()` overrides are silently bypassed over WebSocket—though they are correctly enforced on the initial HTTP GET request. The attack vector is network-based with no authentication required and no user interaction necessary; an anonymous or under-privileged client can open a WebSocket connection and mount protected views, dispatching their handlers with full access. This affects all djust views using standard Django authorization patterns prior to version 1.0.7. The fix (released in djust 1.0.7) extends `check_view_auth` to honor Django's `AccessMixin` family on all transports, adds a system check (S004) to detect unsafe auth patterns at startup, and enforces `login_required` and staff-gate checks in the admin extension.

## Affected products

- djust-org djust < 1.0.7

## Identifiers

- CVE-2026-61594
- GHSA-xhhm-f6hp-2qwj
- PYSEC-2026-4047

## Timeline

- 2026-06-22: disclosed
- 2026-06-22: patched: Fixed in djust 1.0.7
- 2026-09-16: advisory

## References

- [https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj](https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj)
- [https://github.com/djust-org/djust/releases/tag/v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)
- [https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-xhhm-f6hp-2qwj](https://api.github.com/repos/djust-org/djust/security-advisories/GHSA-xhhm-f6hp-2qwj)

## Related threats

- [djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.](https://junglewise.ai/threats/cve-2026-113731-djust-provides-phoenix-liveview-style-reactive-server-side)
- [djust template XSS via inherited context safety grant](https://junglewise.ai/threats/djust-template-xss-via-inherited-context-safety-grant-eaaae5cf)
- [djust multiple template-layer cross-site scripting flaws](https://junglewise.ai/threats/djust-six-template-layer-defects-emit-attacker-controlled-markup-54f3f871)
- [djust unauthenticated arbitrary module import in WebSocket/SSE](https://junglewise.ai/threats/cve-2026-61599-djust-unauthenticated-arbitrary-module-import-in-websocket-sse)
- [djust broken object-level access control (IDOR)](https://junglewise.ai/threats/cve-2026-61596-djust-broken-object-level-access-control-idor)