Open redirect in Directus - CVE-2026-35410
Published: April 23, 2026
Vulnerability identifier: #VU127129
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-35410
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to redirect users to an arbitrary external domain.
The vulnerability exists due to url redirection to an untrusted site in the isLoginRedirectAllowed function when processing login redirection URLs. A remote attacker can supply a specially crafted login URL to redirect users to an arbitrary external domain.
User interaction is required, and the issue is particularly impactful in OAuth2 and SAML authentication flows after successful authentication.
Affected software
Directus
How to mitigate CVE-2026-35410
Install security update from vendor's website.
Directus - update to 11.16.1