djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to 1.0.4, LiveViewConsumer.handle_mount sen…

CVE-2026-55571 affects djust, a Phoenix LiveView-style reactive server-side rendering framework for Django with Rust-powered performance. Prior to version 1.0.4, the LiveViewConsumer.handle_mount method sends a navigate redirect frame when authentication or authorization denies a LiveView mount, but fails to close the WebSocket connection or clear the view instance. A malicious raw WebSocket client can ignore the redirect and retain the mounted socket. Since LiveViewConsumer.handle_event does not recheck authentication or authorization, attackers can send event frames to invoke event handler methods without a valid authenticated session. This flaw enables unauthorized sensitive data reads or mutations, including via handle_live_redirect_mount. The vulnerability has been patched in djust version 1.0.4.