CVE-2026-61594 Overview
CVE-2026-61594 is a critical authorization bypass affecting djust, a library providing Phoenix LiveView-style reactive server-side rendering for Django. Versions prior to 1.0.7 authorize WebSocket mounts through check_view_auth rather than Django's View.dispatch() chain. Standard Django authorization mixins and decorators run only on the initial HTTP GET and are silently skipped over the WebSocket transport where events and state actually flow. An unauthenticated or under-privileged client can open a WebSocket, mount a protected view, and dispatch its handlers — including admin list, create, change, and delete operations. The issue is classified under [CWE-306: Missing Authentication for a Critical Function].
Critical Impact
Anonymous WebSocket clients can bypass LoginRequiredMixin, PermissionRequiredMixin, and admin staff gates to reach protected views and admin CRUD operations.
Affected Products
- djust versions prior to 1.0.7
- Django applications using djust live (WebSocket) transport
- djust admin extension relying on the HTTP as_view staff gate
Discovery Timeline
- 2026-09-16 - CVE-2026-61594 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-61594
Vulnerability Analysis
The flaw stems from a divergence between djust's two transport paths. Over HTTP, djust wraps views with as_view, which invokes Django's View.dispatch() chain and honors standard authorization primitives. Over WebSocket, djust mounts the view directly and delegates authorization to check_view_auth, a shortcut that does not replay dispatch().
As a result, LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method_decorator(login_required, name="dispatch"), and custom dispatch() guards are enforced only on the initial page load. The djust admin extension's staff gate, applied inside the HTTP as_view wrapper, is also skipped. All subsequent events and state transitions flow through the unauthenticated WebSocket path.
An attacker can connect to the WebSocket endpoint, mount a protected view — including admin list, create, change, and delete views — and dispatch its handlers as an anonymous or under-privileged user. The impact spans confidentiality and integrity of any data managed through djust-mounted views.
Root Cause
The root cause is inconsistent authorization enforcement across transports. check_view_auth did not honor the Django AccessMixin family, and the admin base mixin did not declare djust-native gates that apply to every transport. Authorization decisions expressed as dispatch()-time logic could not be safely replayed by the runtime and were silently dropped on WebSocket connections.
Attack Vector
Exploitation requires only network access to the djust WebSocket endpoint. An attacker establishes a WebSocket connection, sends a mount message referencing a protected view, and issues event messages that invoke handler methods. No authentication, user interaction, or specialized tooling is required. See the GitHub Security Advisory GHSA-xhhm-f6hp-2qwj for protocol-level details.
Detection Methods for CVE-2026-61594
Indicators of Compromise
- WebSocket mount messages targeting admin views from sessions without an authenticated user
- Event dispatches against protected views following mounts by anonymous clients
- Unexpected create, change, or delete operations on models exposed through djust admin views
- Application logs showing successful handler execution absent a preceding authenticated HTTP request
Detection Strategies
- Correlate WebSocket connection logs with session authentication state at mount time
- Alert on djust mount events for views protected by LoginRequiredMixin or PermissionRequiredMixin when the session is anonymous
- Compare pre-upgrade HTTP request logs against WebSocket mount targets to spot direct mounts without a prior GET
Monitoring Recommendations
- Enable verbose logging for the djust channel consumer and capture mount and event payloads
- Ship Django and djust logs to a centralized SIEM for query and correlation across transports
- Add startup validation output from the new S004 system check to build and deployment pipelines
How to Mitigate CVE-2026-61594
Immediate Actions Required
- Upgrade djust to version 1.0.7 or later on all environments running the live transport
- Audit every view exposed through djust for HTTP-only authorization patterns and convert them to djust-native gates
- Review recent WebSocket traffic and database change logs for unauthorized admin activity
- Run the S004 system check and resolve any reported auth patterns before returning to production
Patch Information
djust 1.0.7 fixes the bypass by extending check_view_auth to honor the Django AccessMixin family on every transport. A new system check, S004, fails at startup when authorization is expressed as decorators or overridden dispatch() methods that the runtime cannot safely replay. The admin base mixin now declares login_required = True and enforces an active-staff check_permissions gate. Release notes are available in the djust v1.0.7 release.
Workarounds
- Gate views using djust's login_required, permission_required, and check_permissions attributes, which are honored on all transports
- Avoid relying solely on @method_decorator(login_required, name="dispatch") or custom dispatch() guards for djust-mounted views
- Restrict WebSocket endpoint exposure at the reverse proxy until the upgrade is deployed
- Disable the djust admin extension in production if immediate patching is not feasible
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
