CVE-2026-35408

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35408", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T17:03:42.075Z", "datePublished": "2026-04-06T21:30:22.824Z", "dateUpdated": "2026-04-07T16:23:42.264Z"}, "containers": {"cna": {"title": "Directus is Missing Cross-Origin Opener Policy", "problemTypes": [{"descriptions": [{"cweId": "CWE-346", "lang": "en", "description": "CWE-346: Origin Validation Error", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-693", "lang": "en", "description": "CWE-693: Protection Mechanism Failure", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99"}], "affected": [{"vendor": "directus", "product": "directus", "versions": [{"version": "< 11.17.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T21:30:22.824Z"}, "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0."}], "source": {"advisory": "GHSA-8m32-p958-jg99", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T16:23:35.547835Z", "id": "CVE-2026-35408", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T16:23:42.264Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "Directus is Missing Cross-Origin Opener Policy", "source": {"advisory": "GHSA-8m32-p958-jg99", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "directus", "product": "directus", "versions": [{"status": "affected", "version": "< 11.17.0"}]}], "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99", "name": "https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-346", "description": "CWE-346: Origin Validation Error"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-693", "description": "CWE-693: Protection Mechanism Failure"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T21:30:22.824Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35408", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-07T16:23:35.547835Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2026-04-07T16:23:39.269Z"}}]}, "cveMetadata": {"cveId": "CVE-2026-35408", "state": "PUBLISHED", "dateUpdated": "2026-04-06T21:30:22.824Z", "dateReserved": "2026-04-02T17:03:42.075Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T21:30:22.824Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "directus", "vendor": "directus", "versions": [{"status": "affected", "version": "< 11.17.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F2EBB337-0000-4792-940F-DAEFCFC17747", "versionEndExcluding": "11.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0."}, {"lang": "es", "value": "Directus es un panel de control de API y aplicaciones en tiempo real para gestionar contenido de bases de datos SQL. Antes de la versi\u00f3n 11.17.0, las p\u00e1ginas de inicio de sesi\u00f3n de Single Sign-On (SSO) de Directus carec\u00edan de un encabezado de respuesta HTTP Cross-Origin-Opener-Policy (COOP). Sin este encabezado, una ventana maliciosa de origen cruzado que abre la p\u00e1gina de inicio de sesi\u00f3n de Directus conserva la capacidad de acceder y manipular el objeto de ventana de esa p\u00e1gina. Un atacante puede explotar esto para interceptar y redirigir el flujo de autorizaci\u00f3n de OAuth a un cliente OAuth controlado por el atacante, haciendo que la v\u00edctima conceda acceso sin saberlo a su cuenta de proveedor de autenticaci\u00f3n (p. ej., Google, Discord). Esta vulnerabilidad se corrigi\u00f3 en la versi\u00f3n 11.17.0."}], "id": "CVE-2026-35408", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.8, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.8, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35408", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T16:23:35.547835Z", "version": "2.0.3"}}]}, "published": "2026-04-06T22:16:21.557", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-346"}, {"lang": "en", "value": "CWE-693"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.17.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "directus", "source": "cna", "vendor": "directus"}, "product": "directus", "vendor": "directus"}], "analysis": {"en": {"generated_at": "2026-04-07T01:59:40.221512+00:00", "value": {"mitigation_remediation": ["Upgrade Directus to version 11.17.0 or later.", "Verify that the SSO login pages now include the Cross-Origin-Opener-Policy header and exhibit expected behavior."], "summary": {"action": "Apply Patch", "impact": "Unauthorized OAuth redirection leading to account compromise"}, "threat_synthesis": {"affected_systems": "The vulnerability affects instances of Directus running any version prior to 11.17.0. Vendors listed in the CNA entry\u2014Directus Inc.\u2014should review their deployments to confirm whether SSO login pages are exposed. No specific sub\u2011versions are enumerated, so all releases before the patch should be considered at risk.", "description_and_impact": "Directus, a real\u2011time API and dashboard for SQL databases, had a missing Cross\u2011Origin\u2011Opener\u2011Policy header on its Single\u2011Sign\u2011On login pages before version 11.17.0. Because the COOP header was absent, a malicious cross\u2011origin window that opens the Directus login tab could read and write properties of the login page\u2019s window object. Attackers can then intercept the OAuth authorization flow and redirect it to a malicious OAuth client. This allows the victim to unknowingly grant the attacker access to their authentication provider account, such as Google or Discord.", "risk_and_exploitability": "The computed CVSS score of 8.7 indicates a high\u2011severity flaw with a substantial impact on confidentiality and integrity. The lack of an EPSS score or KEV listing suggests that there is currently no widespread exploitation evidence, yet the vulnerability is trivially exploitable by any site that can open the Directus SSO login in a cross\u2011origin context. Attackers would need to entice a user to visit a malicious page that opens, manipulates, and then redirects the OAuth flow, making this vulnerability fall into the realm of social\u2011engineering or web\u2011page manipulation tactics."}}}}, "created": "2026-04-07T06:53:52.806047+00:00", "updated": "2026-04-07T09:36:51.170318+00:00", "vendors": ["directus", "directus$PRODUCT$directus"]}