djust CVE-2026-55571

Exploitation requires a non-browser WebSocket client capable of connecting to the target application's WebSocket endpoint and ignoring server-sent redirect frames - standard browsers follow the navigate frame and are not exploitable. The target application must be running djust prior to 1.0.4 and must expose at least one LiveView decorated with login_required or permission_required, or whose on_mount hook issues a redirect, and that view's @event_handler methods must not independently verify the user. The attacker must know or successfully enumerate at least one valid LiveView path and a callable event handler name on that view. What limits exploitation: the non-browser WebSocket client requirement rules out CSRF-style drive-by attacks; knowledge of specific view paths and event names is necessary; and apps where every @event_handler already independently checks request.user.is_authenticated are not vulnerable even on affected versions. Exploitation is not possible against djust 1.0.4 or later.

The CVSS 8.2 score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N accurately reflects the severity of the authentication bypass: unauthenticated network exploitation with high integrity impact and low attack complexity. The I:H rating is grounded in the fact that all state-mutating event handlers on any gated LiveView are reachable by an anonymous WebSocket client. EPSS score was not provided in the source data. There is no CISA KEV listing, so confirmed in-the-wild exploitation is not established; however, a proof-of-concept WebsocketCommunicator reproducer was disclosed in the GHSA advisory alongside the patch, lowering the bar for exploitation. The primary real-world limiting factor is that standard browsers are not exploitable - they obey the navigate frame and disconnect - which restricts opportunistic, drive-by exploitation but does not protect against targeted attacks using basic WebSocket tooling such as wscat, Python websockets, or curl. The deployment footprint of djust is niche compared to mainstream frameworks, which reduces aggregate exposure, but individual applications with sensitive mutations (write operations, data deletion, financial actions) behind login_required LiveViews face meaningful risk until patched.

An attacker targeting a djust application uses a raw WebSocket client to connect to a known gated LiveView endpoint (e.g., /ws/live/admin-dashboard/). When the server responds with {"type":"navigate","to":"/login/"}, the client silently ignores the frame rather than disconnecting, then sends {"type":"event","name":"delete_user","params":{"user_id":99}}. Because handle_event never rechecks authentication, the delete_user handler executes under an anonymous session and completes the unauthorized mutation. A WebsocketCommunicator proof-of-concept reproducer demonstrating this bypass was disclosed as part of GHSA-xx4j-w367-7247.