CVE-2026-35408 Details
Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0.
A vulnerability exists in Directus Single Sign-On (SSO) login pages prior to version 11.17.0, where the Cross-Origin-Opener-Policy (COOP) HTTP response header was missing. This absence allowed a malicious cross-origin window to access and manipulate the window object of the Directus login page. An attacker could exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, potentially leading to unauthorized access to the victim's authentication provider account, such as Google or Discord. This vulnerability has been addressed in Directus version 11.17.0.
Users can upgrade to Directus version 11.17.0 or later to address this vulnerability. Alternatively, those unable to upgrade immediately can configure their reverse proxy or web server to add the 'Cross-Origin-Opener-Policy: same-origin' HTTP response header to all Directus responses.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-346 | Origin Validation Error | [email protected] |
| CWE-693 | Protection Mechanism Failure | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| monospace directus | < 11.17.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |