CVE-2026-55571

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.4

Description An authentication bypass exists in the LiveViewConsumer when a view is restricted by login required, permission required, or a redirecting on mount hook. In these cases, the handle mount() function sends a navigation frame to the client but fails to close the WebSocket connection or clear the self.view instance variable. While standard browsers follow the redirect, a raw WebSocket client can ignore it and maintain an open socket. Since the handle event() function does not re-verify authentication or authorization, an unauthenticated client can send event frames to invoke @event handler methods, potentially leading to unauthorized sensitive data reads or mutations. This behavior also affects the handle live redirect mount() function.

Recommendations Update to version 1.0.4. As a temporary workaround, ensure that every @event handler on a gated LiveView independently verifies that the request user is authenticated and authorized. As an alternative workaround, override the consumer's handle mount() function to execute await self.close(code=4403) after emitting an authentication redirect. Enable the defense-in-depth control by setting LIVEVIEW CONFIG['reauth on event'] = True to re-run authentication checks on every event for gated views.