EUVD-2026-80744
GHSA-8g2f-g3gq-5rjv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed observability endpoint over network
-
DeliveryConfirm DEBUG on, middleware absent
-
ExploitRead live view/session state
-
ExecutionInvoke eval_handler remote methods
-
ImpactManipulate application state / exfiltrate session data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the specific documented-but-misconfigured state: Django DEBUG=True in production AND the opt-in localhost-restriction middleware not installed, leaving djust's observability endpoints (live view/session state plus the eval_handler method-invocation surface) reachable from a non-localhost network client. Limiting factors: exploitation is impossible when DEBUG=False (the documented workaround), when the localhost middleware is installed, or on djust >= 1.0.7 where the localhost gate is enforced in-view on every observability endpoint and eval_handler is restricted with a non-disclosing response for gated requests. No authentication is required (PR:N) and no user interaction is needed, but the reliance on two non-default conditions is why the CVSS carries AC:H. |
| Impact | The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, base 7.4) is well-calibrated: network-reachable and unauthenticated (PR:N), but gated by AC:H because exploitation requires a specific misconfiguration - DEBUG left on in production AND the opt-in localhost middleware not installed. CWE-306 (missing authentication for a critical function) fits the eval_handler remote method-invocation surface. No EPSS score, no CISA KEV listing, and no public POC are provided, so despite the high base score there is no signal of active or widespread exploitation. The 'Authentication Bypass' tag overstates slightly - there was never an auth layer to bypass on the observability endpoints, only a DEBUG check plus an omitted middleware, which is closer to missing access control. Real-world priority is moderate: genuinely dangerous where the documented (flawed) setup is followed and endpoints are network-exposed, but the double-condition prerequisite (DEBUG=True in prod is itself an anti-pattern) meaningfully narrows the exposed population. Confidence in the technical facts is high because the vendor GHSA advisory and release notes corroborate the description directly. |
| Exploit ScenarioDerived | A production djust deployment left with DEBUG=True and without the opt-in localhost middleware (the documented setup) exposes its observability endpoints to the network. A remote unauthenticated attacker queries these endpoints to read live view and session state, then calls the eval_handler surface to invoke server-side handler methods remotely. No public POC is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 16, 2026
Unauthenticated remote attackers can read live Django view and session state and invoke server-side handlers through djust's observability endpoints when a deployment leaves DEBUG enabled and omits the optional localhost-restriction middleware. The exposure requires that specific documented-but-misconfigured combination, which is why the assessed base score of 7.4 carries AC:H despite being network-reachable with PR:N - the endpoints themselves enforced only DEBUG prior to version 1.0.7. No public exploit code has been identified at time of analysis, and the flaw (CWE-306, missing authentication for critical function) is fully neutralized by upgrading to 1.0.7, by setting DEBUG=False, or by installing the localhost-gating middleware.
RemediationAI
Apply the vendor-released patch by upgrading djust to 1.0.7 or later (pip install --upgrade djust), per the advisory at https://github.com/djust-org/djust/security/advisories/GHSA-8g2f-g3gq-5rjv and the release at https://github.com/djust-org/djust/releases/tag/v1.0.7; this version enforces the localhost restriction in-view on every observability endpoint instead of depending on a separately installed middleware, restricts eval_handler, and returns a non-disclosing response for gated requests, so no additional configuration is needed for the core fix. If immediate upgrade is not possible, the vendor workaround is to set DEBUG=False in all production deployments - this is the only view-level control that was actually enforced in vulnerable releases, so leaving DEBUG on cannot be compensated for; be aware that turning DEBUG off also disables Django's automatic static-file serving and verbose error pages, so configure static file handling and error reporting separately to avoid operational breakage. Additionally, install the localhost-restriction middleware that the documentation omitted (or block the observability endpoint paths and eval_handler at the reverse proxy or network boundary), with the trade-off that reverse-proxy path blocking is brittle if endpoint routes change and the middleware approach re-introduces the opt-in dependency that caused this flaw in the first place. There is no vendor-released patch identified for versions other than 1.0.7, so backporting is not a supported path.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in pypi
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
djust is a Python package that brings Phoenix LiveView-style reactive server-side rendering to Django, using a Rust-backed rendering path for performance. To support debugging and introspection, it ships observability endpoints that surface live view and session state, plus an eval_handler surface that allows remote method invocation against server-side handlers. The root-cause class is CWE-306, missing authentication for a critical function: rather than enforcing the localhost restriction inside each observability view, djust delegated that check to an opt-in middleware which the project's own documented setup omits, leaving the views to gate only on Django's DEBUG setting. The result is a configuration-dependent authorization gap, matching the CVSS:3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - reachable over the network with no credentials and no user interaction, but requiring the prerequisite state of DEBUG=True in production plus the absent middleware, hence the high attack complexity. Confidentiality and integrity impacts are high (live application state disclosure and remote handler invocation); availability impact is none. The identified CPE cpe:2.3:a:djust-org:djust:*:*:*:*:*:*:*:* is a broad wildcard from the CVE feed, while the vendor advisory narrows the affected range to versions before 1.0.7.
Know when Djust gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Network-reachable and unauthenticated (PR:N) but gated by the DEBUG-on-plus-missing-middleware misconfiguration (AC:H); state disclosure gives C:H and eval_handler invocation gives I:H, with no availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (eval_handler). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and eval_handler is restricted; gated requests receive a non-disclosing response. As a workaround, ensure DEBUG=False in production, and do not expose the observability endpoints to untrusted networks.
Technical POC Analysis
CWE-306 (Missing Authentication for Critical Function), with CWE-668 (Exposure of Resource to Wrong Sphere) as the secondary weakness in the advisory.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
Organizations running the djust library in Django deployments that have left DEBUG enabled and omitted the optional localhost-restriction middleware are exposing live application view and session state to unauthenticated network users, along with the ability to invoke server-side handlers. The exposure depends on a documented but insecure configuration rather than a default install, yet where it exists it can leak session material and application internals to anyone who can reach the service. Leadership should treat this as both a configuration-hygiene failure and a patch-management item for internet-facing Django workloads, since remediation is achievable through a configuration change or a version upgrade.
No vendor-released patch identified at time of analysis; interim mitigations are to set DEBUG=False, install the optional localhost-restriction middleware that gates the observability endpoints, and restrict network reachability to those endpoints to localhost or trusted management hosts. Upgrading to djust 1.0.7 is documented as fully neutralizing the flaw.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected e
Cross-site request forgery in djust's Server-Sent-Events transport affects all versions prior to 1.0.7 and allows a cros
Mass assignment in djust, a Django library providing Phoenix LiveView-style reactive server-side rendering, allows any c
Exploit-DB