CVE-2026-35410

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*

History

24 Jul 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Directus es un API en tiempo real y un panel de control de aplicaciones para gestionar contenido de base de datos SQL. Antes de la versión 11.16.1, existe una vulnerabilidad de redirección abierta en la lógica de redirección de inicio de sesión. La función isLoginRedirectAllowed no logra identificar correctamente ciertas URL malformadas como externas, permitiendo a los atacantes eludir la validación de la lista de permitidos de redirección y redirigir a los usuarios a dominios externos arbitrarios tras una autenticación exitosa. Esta vulnerabilidad está corregida en la versión 11.16.1.

20 Apr 2026, 16:43

Type	Values Removed	Values Added
CPE		cpe:2.3:a:monospace:directus::::::node.js::*
References	~~() https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj -~~	() https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj - Vendor Advisory
First Time		Monospace Monospace directus

06 Apr 2026, 22:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-04-06 22:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35410

Mitre link : CVE-2026-35410

CVE.ORG link : CVE-2026-35410

JSON object : View

Products Affected

monospace

directus

CWE

CWE-184

Incomplete List of Disallowed Inputs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-35410", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35410", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T14:47:25.463655Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "directus", "product": "directus", "versions": [{"status": "affected", "version": "< 11.16.1"}]}]}], "published": "2026-04-06T22:16:22.097", "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1."}, {"lang": "es", "value": "Directus es un API en tiempo real y un panel de control de aplicaciones para gestionar contenido de base de datos SQL. Antes de la versi\u00f3n 11.16.1, existe una vulnerabilidad de redirecci\u00f3n abierta en la l\u00f3gica de redirecci\u00f3n de inicio de sesi\u00f3n. La funci\u00f3n isLoginRedirectAllowed no logra identificar correctamente ciertas URL malformadas como externas, permitiendo a los atacantes eludir la validaci\u00f3n de la lista de permitidos de redirecci\u00f3n y redirigir a los usuarios a dominios externos arbitrarios tras una autenticaci\u00f3n exitosa. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 11.16.1."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E86A8769-F082-4253-9D48-B6B484CA61FF", "versionEndExcluding": "11.16.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}