CVE-2026-35410

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35410", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T17:03:42.075Z", "datePublished": "2026-04-06T21:32:13.985Z", "dateUpdated": "2026-04-07T15:09:07.019Z"}, "containers": {"cna": {"title": "Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow", "problemTypes": [{"descriptions": [{"cweId": "CWE-184", "lang": "en", "description": "CWE-184: Incomplete List of Disallowed Inputs", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-601", "lang": "en", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj"}], "affected": [{"vendor": "directus", "product": "directus", "versions": [{"version": "< 11.16.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T21:32:13.985Z"}, "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1."}], "source": {"advisory": "GHSA-cf45-hxwj-4cfj", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T14:47:25.463655Z", "id": "CVE-2026-35410", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T15:09:07.019Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35410", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T14:47:25.463655Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:47:31.139Z"}}], "cna": {"title": "Directus has an Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow", "source": {"advisory": "GHSA-cf45-hxwj-4cfj", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "directus", "product": "directus", "versions": [{"status": "affected", "version": "< 11.16.1"}]}], "references": [{"url": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj", "name": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-184", "description": "CWE-184: Incomplete List of Disallowed Inputs"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-601", "description": "CWE-601: URL Redirection to Untrusted Site ('Open Redirect')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T21:32:13.985Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35410", "state": "PUBLISHED", "dateUpdated": "2026-04-07T15:09:07.019Z", "dateReserved": "2026-04-02T17:03:42.075Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T21:32:13.985Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "directus", "vendor": "directus", "versions": [{"status": "affected", "version": "< 11.16.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:monospace:directus:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "E86A8769-F082-4253-9D48-B6B484CA61FF", "versionEndExcluding": "11.16.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1."}, {"lang": "es", "value": "Directus es un API en tiempo real y un panel de control de aplicaciones para gestionar contenido de base de datos SQL. Antes de la versi\u00f3n 11.16.1, existe una vulnerabilidad de redirecci\u00f3n abierta en la l\u00f3gica de redirecci\u00f3n de inicio de sesi\u00f3n. La funci\u00f3n isLoginRedirectAllowed no logra identificar correctamente ciertas URL malformadas como externas, permitiendo a los atacantes eludir la validaci\u00f3n de la lista de permitidos de redirecci\u00f3n y redirigir a los usuarios a dominios externos arbitrarios tras una autenticaci\u00f3n exitosa. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 11.16.1."}], "id": "CVE-2026-35410", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35410", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T14:47:25.463655Z", "version": "2.0.3"}}]}, "published": "2026-04-06T22:16:22.097", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-184"}, {"lang": "en", "value": "CWE-601"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.16.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "directus", "source": "cna", "vendor": "directus"}, "product": "directus", "vendor": "directus"}], "analysis": {"en": {"generated_at": "2026-04-07T01:59:02.824840+00:00", "value": {"mitigation_remediation": ["Upgrade Directus to version 11.16.1 or later.", "If upgrading is not immediately possible, restrict authentication redirect URLs to trusted domains and validate them before redirecting.", "Monitor authentication logs for unexpected redirect destinations and block suspicious activity."], "summary": {"action": "Patch", "impact": "Open redirect during authentication"}, "threat_synthesis": {"affected_systems": "Affected systems are Directus installations running any version prior to 11.16.1. The vulnerability is present in the directus:directus product and was fixed in Directus 11.16.1. Users of earlier releases should evaluate their environment and prepare an upgrade.", "description_and_impact": "The vulnerability arises from the login redirect logic in Directus before version 11.16.1. The isLoginRedirectAllowed function fails to correctly detect malformed URLs as external. This allows attackers to bypass the redirect allow-list and send users to arbitrary external domains after authentication. The primary impact is that authenticated users can be redirected to malicious sites, enabling phishing and credential harvesting.", "risk_and_exploitability": "Risk assessment: The CVSS score is 6.1, indicating moderate severity. EPSS is not provided, and the vulnerability is not listed in CISA KEV. The attack vector is likely remote and requires an attacker to supply a crafted redirect parameter during the OAuth2/SAML authentication flow. Because the exploit is straightforward once the login flow is accessed, the potential for malicious redirection is significant, especially in environments where users trust the application for authentication. Therefore, the risk is moderate but still warrants prompt remediation."}}}}, "created": "2026-04-07T06:53:49.893555+00:00", "updated": "2026-04-07T09:36:48.185894+00:00", "vendors": ["directus", "directus$PRODUCT$directus"]}