CVE-2026-55571 – Authentication Bypass via WebSocket Persistence – djust < 1.0.4

Summary

CVE-2026-55571 is a high-severity (CVSS 8.2) authentication bypass vulnerability affecting djust, a Python LiveView-style library for building real-time server-rendered UIs over WebSockets. The flaw resides in LiveViewConsumer, which fails to terminate the WebSocket connection when a mount is denied by login_required, permission_required, or a redirecting on_mount hook. Because the underlying socket and view instance remain alive after the denial, an unauthenticated or unauthorized client can continue dispatching handle_event calls against the gated view, effectively bypassing the intended access control on mutation operations.

Technical details

• Root cause: LiveViewConsumer.handle_mount sends a client-side navigation/redirect frame when access is denied (e.g., by login_required, permission_required, or a redirecting on_mount hook), but does not close the underlying WebSocket connection or clear the associated view instance.
• Trigger conditions: An attacker establishes a WebSocket connection to a LiveView that enforces authentication or authorization at mount time. When the mount is denied, the server issues a redirect frame but leaves the socket open with the view instance still initialized.
• Attack vector: Network-based (AV:N), no privileges required (PR:N), no user interaction (UI:N), low attack complexity (AC:L). The attacker simply keeps the "denied" socket open instead of following the redirect, then sends crafted event frames directly.
• Impact: Because subsequent handle_event calls are not rechecked for authentication/authorization after the initial denial, an unauthenticated client can invoke event-handler logic on the gated view — enabling unauthorized state mutations without ever completing login or permission checks. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) reflects low confidentiality impact but high integrity impact, with no direct availability impact.

Affected software

• djust (PyPI package) versions prior to 1.0.4

Severity

• CVSS v3.1 Base Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
• Associated weaknesses: CWE-285 (Improper Authorization), CWE-306 (Missing Authentication for Critical Function)

Mitigation and recommended actions

• Immediate: Upgrade djust to version 1.0.4 or later. This release closes the WebSocket connection (with close code 4403) and clears the view instance whenever a mount is denied, preventing further event dispatch on the stale connection. Version 1.0.4 also introduces an optional defense-in-depth setting to force re-authentication/re-authorization checks on every event, which is recommended for high-sensitivity views.
• If immediate patching is not possible:
  • Audit LiveView consumers that rely on login_required, permission_required, or redirecting on_mount hooks, and add explicit authorization checks inside handle_event handlers rather than relying solely on mount-time gating.
  • Monitor and terminate long-lived WebSocket connections that follow a denied mount, at the application or reverse-proxy layer, as a temporary compensating control.
  • Restrict network exposure of WebSocket endpoints serving gated views until the patch can be applied.

References

• CVE-2026-55571 CVE Record (cvelistV5)
• GHSA-xx4j-w367-7247 – djust GitHub Security Advisory
• djust fix commit and PR #1780