CVE-2026-22032

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22032", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T22:30:38.719Z", "datePublished": "2026-01-08T14:32:06.619Z", "dateUpdated": "2026-01-15T14:53:09.871Z"}, "containers": {"cna": {"title": "Directus has open redirect in SAML", "problemTypes": [{"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/directus/directus/security/advisories/GHSA-3573-4c68-g8cc", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/directus/directus/security/advisories/GHSA-3573-4c68-g8cc"}, {"name": "https://github.com/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23", "tags": ["x_refsource_MISC"], "url": "https://github.com/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23"}], "affected": [{"vendor": "directus", "product": "directus", "versions": [{"version": "< 11.14.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T14:32:06.619Z"}, "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch."}], "source": {"advisory": "GHSA-3573-4c68-g8cc", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T14:48:13.625019Z", "id": "CVE-2026-22032", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:53:09.871Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22032", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T14:48:13.625019Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-15T14:53:05.896Z"}}], "cna": {"title": "Directus has open redirect in SAML", "source": {"advisory": "GHSA-3573-4c68-g8cc", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "directus", "product": "directus", "versions": [{"status": "affected", "version": "< 11.14.0"}]}], "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-3573-4c68-g8cc", "name": "https://github.com/directus/directus/security/advisories/GHSA-3573-4c68-g8cc", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23", "name": "https://github.com/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-08T14:32:06.619Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22032", "state": "PUBLISHED", "dateUpdated": "2026-01-15T14:53:09.871Z", "dateReserved": "2026-01-05T22:30:38.719Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-08T14:32:06.619Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "directus", "vendor": "directus", "versions": [{"status": "affected", "version": "< 11.14.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "DB17C72D-7DA6-4F3F-9642-454A8C3F77DE", "versionEndExcluding": "11.14.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch."}, {"lang": "es", "value": "Directus es un API en tiempo real y un panel de control de aplicaciones para gestionar contenido de base de datos SQL. Antes de la versi\u00f3n 11.14.0, existe una vulnerabilidad de redirecci\u00f3n abierta en el endpoint de callback de autenticaci\u00f3n SAML de Directus. Durante la autenticaci\u00f3n SAML, el par\u00e1metro 'RelayState' est\u00e1 destinado a preservar el destino original del usuario. Sin embargo, mientras que el flujo de inicio de sesi\u00f3n valida los objetivos de redirecci\u00f3n contra dominios permitidos, esta validaci\u00f3n no se aplica al endpoint de callback. Esto permite a un atacante crear una solicitud de autenticaci\u00f3n maliciosa que redirige a los usuarios a una URL externa arbitraria al finalizar. La vulnerabilidad est\u00e1 presente tanto en las rutas de manejo de \u00e9xito como de error del callback. Esta vulnerabilidad puede ser explotada sin autenticaci\u00f3n. La versi\u00f3n 11.14.0 contiene un parche."}], "id": "CVE-2026-22032", "lastModified": "2026-06-17T10:19:23.553", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22032", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T14:48:13.625019Z", "version": "2.0.3"}}]}, "published": "2026-01-08T15:15:45.000", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23"}, {"source": "security-advisories@github.com", "tags": ["Third Party Advisory"], "url": "https://github.com/directus/directus/security/advisories/GHSA-3573-4c68-g8cc"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:44:21.856578+00:00", "value": {"mitigation_remediation": ["Upgrade Directus to version\u00a011.14.0 or newer, which includes the patch for the callback validation issue.", "If an upgrade cannot be performed immediately, configure Directus to validate the RelayState value against a whitelist of allowed redirect domains before executing the redirect in the SAML callback.", "Monitor authentication and redirect logs for unusual or unexpected SAML callback traffic, especially from unknown or untrusted origins."], "summary": {"action": "Patch", "impact": "Open Redirect via SAML callback"}, "threat_synthesis": {"affected_systems": "The affected product is Directus, an open\u2011source database content management API and dashboard. Versions of Directus prior to 11.14.0 contain the flaw, and the issue is present in both the success and error paths of the SAML callback endpoint.", "description_and_impact": "Directus enables the use of SAML authentication where the RelayState parameter is meant to return users to their original destination after login. Prior to version 11.14.0 the callback endpoint for SAML does not enforce that RelayState points only to allowed domains. This omission allows an attacker to manipulate the parameter so that, after an authentication attempt, the user is redirected to any external URL. The flaw is a classic open\u2011redirect weakness (CWE\u2011601). Should a user click a malicious link in an email or on a website that points to the compromised Directus instance, they could be steered to phishing sites or other malicious content, undermining user trust and potentially enabling credential theft or session hijacking. The vulnerability can be exercised without needing to log in first; any recipient of a crafted authentication request can send a user to an arbitrary destination. The attacker\u2019s capability is limited to redirecting a legitimate user but not to modifying data or gaining direct access to the Directus system.", "risk_and_exploitability": "The CVSS score is 4.3, reflecting a moderate impact. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted SAML authentication request that exploits the open redirect exactly when the callback is processed; an attacker does not need to authenticate to the Directus instance to trigger the flaw. While the risk is not high, the possibility of using the redirect in a phishing or social engineering attack warrants attention."}}}}, "created": "2026-01-09T13:24:47.437555+00:00", "updated": "2026-04-18T16:45:05.231961+00:00", "vendors": ["directus", "directus$PRODUCT$directus"]}