CVE-2026-55571 djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls
Unauthenticated attackers can bypass LiveView mount redirects to execute event handlers, enabling unauthorized data access or modification in djust applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55571?
CVE-2026-55571 is a high-severity authentication bypass vulnerability in djust-org djust, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sends a `{"type":"navigate","to":...}` frame when login_required, permission_required, or a redirecting on_mount hook denies a LiveView mount, but returns without closing the WebSocket or clearing self.view_instance. A browser follows the redirect, but a raw WebSocket client can ignore it and retain the mounted socket. Because LiveViewConsumer.handle_event does not recheck authentication or authorization, the client can send `{"type":"event",...}` frames that invoke @event_handler methods without an authenticated session, including through handle_live_redirect_mount, enabling unauthorized sensitive reads or mutations. This issue is fixed in version 1.0.4.
Which versions are affected by CVE-2026-55571?
3 open source packages ship an affected version, including djust.
| Package | Affected | Fixed in |
|---|---|---|
djust PyPI | All versions | 1.0.4 |
djust PyPI | All versions | 1.0.4 |
djust PyPI | All versions | 1.0.4 |
How do I fix CVE-2026-55571?
Upgrade djust to 1.0.4 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-55571 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55571 exists.
Sources
Also known as GHSA-xx4j-w367-7247, PYSEC-2026-3829.