CVE-2026-61589: medium-severity vulnerability in djust-org djust
djust: WebSocket/runtime reconstructed request omits the client Host, causing host/subdomain TenantResolvers to misresolve the tenant on the live path
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.2%
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket `handle_mount` and `ViewRuntime._build_request` rebuild an `HttpRequest` via `RequestFactory().get(...)` with no `HTTP_HOST`, so `request.get_host()` defaulted to `"testserver"` on the live path. Host/subdomain/domain `TenantResolver`s then misresolved the tenant — `None` on the live path while the HTTP path resolved correctly. With `STRICT_MODE=False` the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy). This is fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against `ALLOWED_HOSTS` (the same logic as the CSWSH Origin gate, parsed with Django's `split_domain_port` so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly. There is no known workaround on the live path short of upgrading. Users are most exposed when combined with `STRICT_MODE=False`.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
djust-org · djustRelated CVEs — djust-org djust
In the same product, most dangerous first.
CVE-2026-61599HIGHdjust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount pathEPSS 0.6%CVE-2026-55571HIGHdjust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler callsEPSS 0.5%CVE-2026-61594CRITICALdjust has an authorization bypass on the WebSocket/SSE mount pathEPSS 0.5%CVE-2026-61598HIGHClient mass-assignment of arbitrary view attributes via the default dj-model update_model handlerEPSS 0.4%CVE-2026-61597MEDIUMdjust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tagsEPSS 0.4%CVE-2026-61592HIGHdjust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)EPSS 0.4%