The vulnerability occurs in the djust LiveView consumer when a user with an authentication requirement or a redirecting on_mount hook denies a mount request. Instead of closing the WebSocket, the server sends a navigation frame and leaves the socket open. Because LiveViewConsumer.handle_event does not re‑check authentication, any raw WebSocket client that ignores the redirect can continue to dispatch event frames that trigger server‑side event handlers. This allows an unauthenticated client to invoke privileged logic, potentially reading or modifying sensitive data. The weakness stems from improper authorization (CWE-285) and missing authentication (CWE-306).

The affected product is djust provided by djust-org. All releases prior to 1.0.4 are vulnerable; the fix is included in release 1.0.4.

The CVSS score of 8.2 indicates a high severity with potential for authentication bypass and privilege escalation. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a raw WebSocket client that can reach the LiveView endpoint, which must know the event signatures and accept the redirect. While the attack requires some knowledge of the event handling mechanisms, an attacker with network access to the exposed endpoint can exploit the flaw to invoke arbitrary event handlers and obtain unauthorized data or alter state, representing a significant security risk.