Server-Side Rendering Vulnerability in djust's LiveViewConsumer for Django

CVE-2026-55571

What is CVE-2026-55571?

The djust framework's LiveViewConsumer component, particularly prior to version 1.0.4, is susceptible to a flaw whereby a WebSocket connection is not terminated upon unauthorized actions during a LiveView mount. When certain hooks such as login_required or permission_required deny the mount, the WebSocket client may not receive the closure signal. If exploited, an attacker could send unauthorized events through the established socket, resulting in sensitive data exposure or unauthorized modifications.

References