CVE-2026-35410
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
Directus prior to version 11.16.1 contains an open redirect vulnerability in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication.
Risk Assessment
An attacker can exploit this vulnerability for phishing, redirecting authenticated users to malicious sites, potentially leading to data theft or further attacks.
Recommendation
Update Directus to version 11.16.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1.