# CVE-2024-34709: Directus session token invalidation bypass

Source: https://junglewise.ai/threats/cve-2024-34709-directus-session-token-invalidation-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-05-13. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-34709 · Severity: low · CVSS 3.1 · Published 2024-05-13

Directus is a headless CMS platform that manages database content and user access. Session tokens are not properly invalidated after logout; if an attacker captures a session token (e.g., from browser history on a shared computer), they can use it to access the system for up to 24 hours even after the legitimate user logs out, potentially gaining access to sensitive content and administrative functions.

Technologies: [directus (npm)](https://junglewise.ai/threats/technologies/directus). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2024-34709 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-34709 being exploited in the wild.

**How severe is CVE-2024-34709?** Low severity, with a CVSS score of 3.1, published 13 May 2024.

**Which products and versions are affected?** directus (npm) SEMVER:introduced=10.10.0,fixed=10.11.0.

**Is there a fix for CVE-2024-34709?** Yes. directus (npm): upgrade to 10.11.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-34709 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-34709?** Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- directus (npm): upgrade to 10.11.0 or later

  ```sh
  npm install directus@10.11.0
  ```


## Technical details

This vulnerability is a session expiration flaw (CWE-613) affecting Directus versions 10.10.0 through 10.10.x. When users log out, the directus_session record is destroyed and the HTTP cookie is deleted, but the underlying JWT session token remains valid until its expiry time (default 1 day). An attacker who captures the JWT token value can authenticate without the directus_session check, bypassing the intended stateful session invalidation. The attack requires low privileges (authenticated user context) and user interaction to obtain a valid token, but once captured, the token provides unauthorized access. The fix, released in version 10.11.0, ensures that session token validation checks both the JWT's cryptographic validity and the existence and validity of the associated directus_session record.

## Affected products

- Directus Directus 10.10.0 to 10.10.x

## Identifiers

- CVE-2024-34709
- GHSA-g65h-35f3-x2w3

## Timeline

- 2024-05-13: disclosed
- 2024-05-13: patched: Fixed in version 10.11.0

## References

- [https://github.com/directus/directus/security/advisories/GHSA-g65h-35f3-x2w3](https://github.com/directus/directus/security/advisories/GHSA-g65h-35f3-x2w3)

## Related threats

- [Directus authorization bypass via unsegmented response cache key](https://junglewise.ai/threats/cve-2026-61836-directus-authorization-bypass-via-unsegmented-response-cache-key)
- [Directus SSRF bypass in file import via 0.0.0.0 address](https://junglewise.ai/threats/cve-2026-61835-directus-ssrf-bypass-in-file-import-via-0-0-0-0-address)
- [Directus sensitive information disclosure via aggregate queries](https://junglewise.ai/threats/cve-2026-35442-directus-sensitive-information-disclosure-via-aggregate-queries)
- [Directus resource exhaustion via GraphQL alias amplification](https://junglewise.ai/threats/cve-2026-35441-directus-resource-exhaustion-via-graphql-alias-amplification)
- [Directus GraphQL introspection bypass in system endpoint](https://junglewise.ai/threats/cve-2026-35413-directus-graphql-introspection-bypass-in-system-endpoint)