djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

djust: Unsigned client state snapshot is restored as trusted view state (privilege escalation / state injection)

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

djust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust has broken object-level access control (IDOR)

Client mass-assignment of arbitrary view attributes via the default dj-model update_model handler