CVE-2026-61589

Summary

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the WebSocket handle_mount and ViewRuntime._build_request rebuild an HttpRequest via RequestFactory().get(...) with no HTTP_HOST, so request.get_host() defaulted to "testserver" on the live path. Host/subdomain/domain TenantResolvers then misresolved the tenant — None on the live path while the HTTP path resolved correctly. With STRICT_MODE=False the tenant-scoped managers returned unscoped rows (cross-tenant disclosure); with the default they returned an empty queryset (broken tenancy). This is fixed in djust 1.0.7. The handshake Host is extracted from the ASGI scope, validated against ALLOWED_HOSTS (the same logic as the CSWSH Origin gate, parsed with Django's split_domain_port so malformed Hosts are rejected at the boundary), and propagated — with the TLS scheme — into the reconstructed request, so live-path tenant resolution matches HTTP exactly. There is no known workaround on the live path short of upgrading. Users are most exposed when combined with STRICT_MODE=False.

Affected Software

VendorProductVersion RangeStatus
djust-orgdjust< 1.0.7affected

Weaknesses

  • CWE-348: CWE-348: Use of Less Trusted Source
  • CWE-639: CWE-639: Authorization Bypass Through User-Controlled Key

References