CVE-2026-61591 Overview
CVE-2026-61591 is a data integrity vulnerability in djust, a library that provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Versions prior to 1.0.7 embed a state_json snapshot into the client page and restore it as trusted view state on reconnect without any integrity check. An authenticated client can edit the unsigned state_json and return it in the reconnect mount frame to inject arbitrary view attributes. The flaw maps to [CWE-345: Insufficient Verification of Data Authenticity].
Critical Impact
Attackers can flip attributes such as is_admin to True or modify account_id and balance values held in public view attributes, escalating privilege and tampering with business state.
Affected Products
- djust reactive rendering library versions prior to 1.0.7
- Django applications that opt into djust state snapshots
- Views that store authorization or ownership state in public view attributes
Discovery Timeline
- 2026-09-16 - CVE-2026-61591 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-61591
Vulnerability Analysis
The djust framework serializes reactive view state into a state_json object embedded in the rendered client page. When a client reconnects or performs back-navigation, djust restores the snapshot as authoritative view state. Prior to version 1.0.7, this restore path performs no cryptographic integrity check on the snapshot. A client can therefore modify state_json in the DOM and submit it in the reconnect mount frame to override any attribute held in the view.
The issue is amplified by the standard djust programming pattern, which encourages developers to hold business and authorization state in public view attributes. Attributes such as is_admin, account_id, or balance become directly mutable by any authenticated client that owns a session on a vulnerable view.
Root Cause
The root cause is the absence of a signature or message authentication code on the serialized state_json payload. The server treats client-returned snapshots as trusted without verifying authenticity, violating the integrity assumptions of the reactive rendering model.
Attack Vector
Exploitation requires low privileges and network access to a reachable djust view that opts into state snapshots. An attacker authenticates, loads a view containing the snapshot, edits state_json in the client page, then triggers the reconnect mount path so the modified snapshot is returned to the server. The server restores the forged attributes into the live view without validation. Refer to the GitHub Security Advisory GHSA-c67v-vqrp-m5wj for the maintainer's technical description.
Detection Methods for CVE-2026-61591
Indicators of Compromise
- Reconnect mount frames containing state_json payloads whose attribute values diverge from the server's last known view state.
- Unexpected transitions of sensitive view attributes such as is_admin, role, account_id, or balance immediately after a reconnect event.
- Application audit log entries showing privileged actions performed by accounts that were not previously granted the required role.
Detection Strategies
- Instrument djust reconnect handlers to log the pre-restore and post-restore state hashes and diff them for anomalous fields.
- Correlate reconnect frames with subsequent authorization decisions to identify privilege changes originating from a client-supplied snapshot.
- Baseline expected view attribute values per session and alert when reconnect-restored values fall outside the baseline.
Monitoring Recommendations
- Forward Django application logs, djust WebSocket frames, and authorization decisions into a centralized analytics pipeline for cross-event correlation.
- Alert on privilege-sensitive attribute writes (is_admin, role, permissions) that occur without a corresponding server-side authorization event.
- Monitor for repeated reconnect attempts from a single session that carry mutated state_json payloads.
How to Mitigate CVE-2026-61591
Immediate Actions Required
- Upgrade djust to version 1.0.7 or later, where state snapshots are signed and unsigned or forged snapshots are rejected on the back-navigation restore path.
- Audit application code for authorization or ownership state stored in public view attributes and move that state to server-side session context or database-backed checks.
- Review recent authorization decisions and privileged actions for evidence of attribute tampering during the vulnerable window.
Patch Information
The vendor fix is available in djust release v1.0.7. The release signs state snapshots and enforces signature verification before restoring snapshot state on reconnect. See the GitHub Security Advisory GHSA-c67v-vqrp-m5wj for advisory details.
Workarounds
- Do not enable state snapshots on djust views until the upgrade to 1.0.7 or later is complete.
- Do not hold authorization or ownership state in public view attributes; re-derive these values server-side on every action.
- Enforce server-side authorization checks on every state-changing operation rather than relying on view attribute values.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
