djust WebSocket/SSE Transport Bypasses Django Authorization Checks (CVE-2026-61594)

What Happened

According to a GitHub Security Advisory (GHSA-xhhm-f6hp-2qwj) published 2026-09-16, the djust Python package contains an authorization bypass affecting its live WebSocket/SSE transport. Per the advisory, djust's live transport authorizes view mounts via a function called check_view_auth rather than routing through Django's standard View.dispatch() chain. As a result, common Django authorization controls — LoginRequiredMixin, PermissionRequiredMixin, UserPassesTestMixin, @method_decorator(login_required, name="dispatch"), custom dispatch() overrides, and the djust admin extension's staff gate — are enforced on the initial HTTP GET but reportedly silently bypassed once a client upgrades to WebSocket, where all subsequent events and state changes flow. The advisory states an anonymous or under-privileged client could open a WebSocket connection and mount a protected view — including admin list/create/change/delete views — and dispatch its handlers directly.

Why It Matters

This affects any deployment using djust's live/WebSocket transport for views that rely on Django's HTTP-layer authorization mixins or decorators rather than djust-native gating. The advisory carries a CVSS score of 9.1 and is flagged with public proof-of-concept exploit code available, meaning the barrier to exploitation is reportedly low. Because the bypass reportedly reaches admin CRUD handlers, successful exploitation could allow unauthorized read, creation, modification, or deletion of data normally restricted to staff or authenticated users.

What Defenders Should Do Now

• Identify whether your Django applications use djust and, specifically, its live WebSocket/SSE transport for any view — especially admin-facing views.
• Upgrade to djust 1.0.7 or later, where the advisory states check_view_auth now honors Django's AccessMixin family across all transports, a new system check (S004) fails loudly at startup for auth patterns that can't be safely replayed, and the admin base mixin enforces login_required plus an active-staff permission check.
• If immediate upgrade isn't possible, apply the documented workaround: gate views using djust's own login_required, permission_required, or check_permissions attributes, which the advisory states are honored across all transports, rather than relying solely on HTTP-only Django mixins or decorators.
• As a hunting angle, review WebSocket connection and event logs for djust-mounted views (particularly admin views) for anonymous or unexpected-identity sessions establishing connections and dispatching handlers without a corresponding authenticated HTTP session.
• Audit any custom or overridden dispatch() methods on djust-backed views, since the advisory notes these are among the patterns the runtime cannot safely replay over non-HTTP transports.

Developing Intel

This is a same-day advisory and details may evolve as the community and maintainers publish further guidance. This is net-new intelligence, not a df00tech-authored detection — for authoritative details, patch guidance, and updates, see the original GitHub Security Advisory: GHSA-xhhm-f6hp-2qwj.