Django Product Vulnerability in Djust WebSocket Transport by Djust
CVE-2026-61594

9.1CRITICAL

Key Information:

Vendor

Djust-org

Status
Djust
Vendor
CVE Published:
16 September 2026

What is CVE-2026-61594?

The Djust framework, which enables reactive server-side rendering for Django applications, has a security flaw in its WebSocket transport mechanism. Prior to version 1.0.7, the authorization checks during WebSocket mount actions were not properly enforced. Unlike standard HTTP requests that adhere to Django's authorization protocols, unauthorized users could exploit this vulnerability to access sensitive features of the application, including the ability to manage admin views. This issue was rectified in version 1.0.7, where enhanced security measures were put in place to ensure that all transport mechanisms respect the appropriate authorization checks.

Affected Version(s)

djust < 1.0.7

References

https://github.com/djust-org/djust/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/djust-org/djust/releases/tag/v1.0.7
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.