{"vulnerability": "cve-2026-61594", "sightings": [{"uuid": "a5acc1d2-7f3b-43fe-9198-3db479b89290", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a", "content": "# CVE-2026-61594: CVE-2026-61594: Authorization Bypass on WebSocket and SSE Mount Paths in djust\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61594\n\n## Summary\nAn authorization bypass vulnerability exists in the djust framework (djust-org/djust) prior to version 1.0.7. The framework fails to enforce standard Django view-level authorization mechanisms, such as AccessMixins or dispatch decorators, when mounting reactive views over stateful transport layers (WebSockets and Server-Sent Events). Unauthenticated or low-privileged attackers can establish persistent connections to mount arbitrary protected views and execute state-changing event handlers.\n\n## TL;DR\nUnauthenticated remote attackers can bypass Django view-level access controls to mount protected reactive views and execute state-changing event handlers via direct WebSocket or Server-Sent Events (SSE) connections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.1 (Critical)\n- **EPSS Score**: Not listed\n- **Impact**: High (Confidentiality & Integrity)\n- **Exploit Status**: PoC / Verifiable\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- djust-org/djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or later.\n- Use djust-native class-level declarative authorization attributes instead of HTTP-specific mixins or decorators.\n- Run Django system checks to identify vulnerable LiveView configurations.\n\n**Remediation Steps:**\n1. Upgrade djust to version 1.0.7 via pip/poetry: `pip install djust>=1.0.7`\n2. Scan the codebase for any `LiveView` classes using standard Django `LoginRequiredMixin`, `PermissionRequiredMixin`, or custom overridden `dispatch` methods.\n3. Refactor identified views to use native declarative attributes like `login_required = True` or native djust permission gates.\n4. Execute `python manage.py check` to verify there are no active system check violations (specifically `djust.S004`).\n\n## References\n\n- [GitHub Security Advisory GHSA-xhhm-f6hp-2qwj](https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj)\n- [djust Release v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [djust Compare v1.0.6...v1.0.7](https://github.com/djust-org/djust/compare/v1.0.6...v1.0.7)\n- [CVE-2026-61594 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-16T22:31:42.435667Z"}, {"uuid": "5881244b-c9dc-4410-a8c4-bbc404cc0846", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://gist.github.com/alon710/adad858617714b6e11a8b77f97f82b9a", "content": "# CVE-2026-61594: CVE-2026-61594: Authorization Bypass on WebSocket and SSE Mount Paths in djust\n\n> **CVSS Score:** 9.1\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61594\n\n## Summary\nAn authorization bypass vulnerability exists in the djust framework (djust-org/djust) prior to version 1.0.7. The framework fails to enforce standard Django view-level authorization mechanisms, such as AccessMixins or dispatch decorators, when mounting reactive views over stateful transport layers (WebSockets and Server-Sent Events). Unauthenticated or low-privileged attackers can establish persistent connections to mount arbitrary protected views and execute state-changing event handlers.\n\n## TL;DR\nUnauthenticated remote attackers can bypass Django view-level access controls to mount protected reactive views and execute state-changing event handlers via direct WebSocket or Server-Sent Events (SSE) connections.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-862\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.1 (Critical)\n- **EPSS Score**: Not listed\n- **Impact**: High (Confidentiality & Integrity)\n- **Exploit Status**: PoC / Verifiable\n- **KEV Status**: Not listed\n\n## Affected Systems\n\n- djust-org/djust\n- **djust**: < 1.0.7 (Fixed in: `1.0.7`)\n\n## Mitigation\n\n- Upgrade to djust version 1.0.7 or later.\n- Use djust-native class-level declarative authorization attributes instead of HTTP-specific mixins or decorators.\n- Run Django system checks to identify vulnerable LiveView configurations.\n\n**Remediation Steps:**\n1. Upgrade djust to version 1.0.7 via pip/poetry: `pip install djust>=1.0.7`\n2. Scan the codebase for any `LiveView` classes using standard Django `LoginRequiredMixin`, `PermissionRequiredMixin`, or custom overridden `dispatch` methods.\n3. Refactor identified views to use native declarative attributes like `login_required = True` or native djust permission gates.\n4. Execute `python manage.py check` to verify there are no active system check violations (specifically `djust.S004`).\n\n## References\n\n- [GitHub Security Advisory GHSA-xhhm-f6hp-2qwj](https://github.com/djust-org/djust/security/advisories/GHSA-xhhm-f6hp-2qwj)\n- [djust Release v1.0.7](https://github.com/djust-org/djust/releases/tag/v1.0.7)\n- [djust Compare v1.0.6...v1.0.7](https://github.com/djust-org/djust/compare/v1.0.6...v1.0.7)\n- [CVE-2026-61594 CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-61594)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61594) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T00:00:37.086228Z"}, {"uuid": "10badcfa-1be9-41db-8f89-768f4ae3336c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvoegaank725", "content": "\ud83d\udea8 CVE-2026-61594 \u2014 CVSS 9.1 CRITICAL\n\ndjust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performan...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-61594\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-17T00:09:20.600819Z"}, {"uuid": "a54a3a95-d363-464b-b4d2-d478d1cb0088", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61594", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvoehliwq52n", "content": "CVE-2026-61594 - djust\nThe djust web framework lets users bypass normal login checks when connecting via WebSocket, meaning someone without the right permissions could open a WebSocket and reach admin\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#djust #djustorg #pip #CVE #infosec", "creation_timestamp": "2026-09-17T00:10:05.968015Z"}]}