Djust
Monthly
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.
Authentication bypass in djust's WebSocket LiveView consumer allows unauthenticated remote clients to invoke protected event handlers on views gated by login_required, permission_required, or redirecting on_mount hooks. All djust versions prior to 1.0.4 are affected: handle_mount sends a navigate/redirect frame on auth denial but neither closes the WebSocket nor clears self.view_instance, leaving the socket open and exploitable. Because handle_event never rechecks authentication after mount, a non-browser WebSocket client that ignores the redirect can send arbitrary event frames and execute state-mutating or data-reading handlers without an authenticated session. No public exploit identified at time of analysis beyond the WebsocketCommunicator proof-of-concept reproducer disclosed in GHSA-xx4j-w367-7247; this vulnerability is not listed in CISA KEV.