{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/djust--1.0.4/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.2,"id":"CVE-2026-55571"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["djust (\u003c 1.0.4)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["djust"],"content_html":"\u003cp\u003eCVE-2026-55571 affects the djust framework's \u003ccode\u003eLiveViewConsumer\u003c/code\u003e component, which handles LiveView mounts over WebSockets. In versions prior to 1.0.4, the framework fails to properly terminate a WebSocket connection when an authentication-gated view (e.g., using \u003ccode\u003elogin_required\u003c/code\u003e or \u003ccode\u003eon_mount\u003c/code\u003e hooks) triggers a redirect. Instead of closing the socket and clearing the view instance, the server sends a navigate redirect frame and keeps the connection alive.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated attacker using a raw WebSocket client can ignore the redirect frame and continue to send event-dispatching frames. Since the \u003ccode\u003ehandle_event\u003c/code\u003e logic in these versions assumes the mount-time authentication checks are sufficient, it fails to re-verify the session status, allowing for the execution of sensitive event handlers. This bypass is critical for applications that rely solely on mount-level decorators and do not perform independent authorization checks inside individual event handler methods.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker initiates an unauthenticated WebSocket connection to a \u003ccode\u003eLiveView\u003c/code\u003e endpoint protected by \u003ccode\u003elogin_required\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eServer's \u003ccode\u003eLiveViewConsumer\u003c/code\u003e performs the mount check and triggers a redirect response (navigate frame) due to missing authentication.\u003c/li\u003e\n\u003cli\u003eAttacker's custom WebSocket client parses the redirect frame but intentionally refuses to close the connection or navigate away.\u003c/li\u003e\n\u003cli\u003eServer keeps the underlying WebSocket connection open and fails to clear \u003ccode\u003eself.view_instance\u003c/code\u003e from memory.\u003c/li\u003e\n\u003cli\u003eAttacker sends a malformed \u003ccode\u003e{\u0026quot;type\u0026quot;:\u0026quot;event\u0026quot;, ...}\u003c/code\u003e frame targeting an \u003ccode\u003e@event_handler\u003c/code\u003e on the gated view.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eLiveViewConsumer\u003c/code\u003e processes the event frame, bypassing any further security checks, and invokes the target method.\u003c/li\u003e\n\u003cli\u003eThe application logic executes the sensitive handler with an unauthenticated session, resulting in unauthorized data access or state mutation.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated users to invoke sensitive server-side functions within gated views. Impact ranges from unauthorized information disclosure to data manipulation depending on the functionality of the exposed event handlers. Exploitation requires knowledge of specific view paths and event handler names. All djust applications using gated LiveViews on versions prior to 1.0.4 are affected.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate to djust version 1.0.4 or later immediately to apply the patch provided in commit \u003ccode\u003e1ae8aa9\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eFor legacy deployments where patching is not immediately possible, implement explicit authentication and authorization checks at the top of every \u003ccode\u003e@event_handler\u003c/code\u003e within gated views.\u003c/li\u003e\n\u003cli\u003eEnable the defense-in-depth configuration \u003ccode\u003eLIVEVIEW_CONFIG['reauth_on_event'] = True\u003c/code\u003e to mandate session re-verification for all event handlers in gated views.\u003c/li\u003e\n\u003cli\u003eAudit application code for LiveView event handlers that perform mutations without secondary validation against the current session user.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-25T18:50:53Z","date_published":"2026-08-25T18:50:53Z","id":"https://feed.craftedsignal.io/briefs/2026-08-djust-auth-bypass/","summary":"An authentication bypass vulnerability (CVE-2026-55571) in the djust LiveViewConsumer allows unauthenticated attackers to execute event handlers on gated views by maintaining a WebSocket connection after a redirect.","title":"Authentication Bypass in djust LiveViewConsumer","url":"https://feed.craftedsignal.io/briefs/2026-08-djust-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Djust (\u003c 1.0.4)","version":"https://jsonfeed.org/version/1.1"}