CVE-2026-61594: djust Package Authorization Bypass on WebSocket/SSE Mount Path
Summary
CVE-2026-61594: djust has an authorization bypass on the WebSocket/SSE mount path. Affects djust versions < 1.0.7. Fixed in 1.0.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
djust is a Python package designed for building real-time web applications using WebSocket and Server-Sent Events (SSE). It provides a framework for handling live data streams and interactions between clients and servers. However, it has a critical vulnerability that allows unauthorized access to certain functionalities, particularly through WebSocket connections.
Vulnerability Detail
The vulnerability arises from an authorization bypass in the live (WebSocket) transport mechanism of the djust package. Unlike standard Django views that enforce authorization checks through the View.dispatch() chain, djust's WebSocket transport uses check_view_auth, which does not adequately enforce these checks. This oversight allows unauthorized users, including anonymous or under-privileged clients, to access and manipulate views that should be restricted, such as admin functionalities for listing, creating, changing, or deleting resources. The potential ramifications include unauthorized data access and manipulation, posing significant security risks.
How To Fix
Latest published version: 1.2.6 as of 22 Oct 2026
pip install --upgrade "djust==1.2.6"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.7
This is the first release that contains the fix.
pip install --upgrade "djust==1.0.7"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can gate views using djust's built-in attributes such as login_required, permission_required, and check_permissions. These attributes are honored across all transport types, unlike the HTTP-only mixins or decorators. For example, you can implement a view like this:
from djust import login_required
@login_required
def my_view(request):
# Your view logic here
pass
Conclusion
The djust package has a critical vulnerability that allows unauthorized access through WebSocket connections. It is essential for users to update to the patched version 1.0.7 to secure their applications. Implementing the recommended workarounds can also help mitigate risks until the update is applied.
See every vulnerability recorded for djust →
FAQ
The vulnerability is an authorization bypass that allows unauthorized users to access restricted functionalities via WebSocket connections.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 9.1, indicating a critical level of severity.
Update the djust package to version 1.0.7 or later to ensure that all authorization checks are enforced properly.
Yes, you can use djust's login_required, permission_required, and check_permissions attributes to gate views as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for djust.
