CVE-2026-35411

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. This vulnerability is fixed in 11.16.1.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*

History

No history.

Information

Published : 2026-04-06 22:16

Updated : 2026-07-24 21:10

NVD link : CVE-2026-35411

Mitre link : CVE-2026-35411

CVE.ORG link : CVE-2026-35411

JSON object : View

Products Affected

monospace

directus

CWE

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

{"id": "CVE-2026-35411", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35411", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T13:36:55.274555Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "directus", "product": "directus", "versions": [{"status": "affected", "version": "< 11.16.1"}]}]}], "published": "2026-04-06T22:16:22.243", "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. This vulnerability is fixed in 11.16.1."}, {"lang": "es", "value": "Directus es un API en tiempo real y un panel de control de aplicaciones para gestionar contenido de base de datos SQL. Antes de la versi\u00f3n 11.16.1, Directus es vulnerable a una redirecci\u00f3n abierta a trav\u00e9s del par\u00e1metro de consulta redirect en la p\u00e1gina /admin/tfa-setup. Cuando un administrador que a\u00fan no ha configurado la autenticaci\u00f3n de dos factores (2FA) visita una URL manipulada, se le presenta la p\u00e1gina leg\u00edtima de configuraci\u00f3n de 2FA de Directus. Despu\u00e9s de completar el proceso de configuraci\u00f3n, la aplicaci\u00f3n redirige al usuario a la URL controlada por el atacante especificada en el par\u00e1metro redirect sin ninguna validaci\u00f3n. Esta vulnerabilidad podr\u00eda usarse en ataques de phishing dirigidos a administradores de Directus, ya que la interacci\u00f3n inicial ocurre en un dominio de confianza. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 11.16.1."}], "lastModified": "2026-07-24T21:10:00.143", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E86A8769-F082-4253-9D48-B6B484CA61FF", "versionEndExcluding": "11.16.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}