CVE-2026-35410 Details
Description
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1.
An open redirect vulnerability has been identified in Directus versions prior to 11.16.1. The issue arises in the login redirection process, where the 'isLoginRedirectAllowed' function improperly assesses certain malformed URLs as safe. This flaw enables attackers to circumvent redirect allow-list validation, redirecting users to arbitrary external domains after successful authentication. The vulnerability is particularly concerning in Single Sign-On (SSO) scenarios, such as with OAuth2 providers, where an attacker can manipulate a login URL to redirect a user to a malicious site immediately after authentication, without any warning during the login process.
Users can upgrade to Directus version 11.16.1 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-184 | Incomplete List of Disallowed Inputs | [email protected] |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| monospace directus | < 11.16.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | New CVE Received | [email protected] |