Executive brief
Directus is a flexible backend platform that provides CMS and API capabilities with SAML-based single sign-on support. An open redirect vulnerability in the SAML authentication callback allows attackers to redirect users to arbitrary external websites without authentication. This can be exploited for phishing attacks to steal credentials or OAuth tokens, undermining user trust in the application's security.
Technical details
The vulnerability is a CWE-601 URL redirect to untrusted site in Directus's SAML authentication flow. The root cause is insufficient validation of the RelayState parameter in the authentication callback endpoint; while the login initiation flow validates redirect targets against allowed domains, this validation is missing from the callback handler. The attack requires user interaction (users must complete a SAML authentication flow) but no privileges, and is reachable over the network. An attacker can craft a malicious SAML authentication request that, upon completion, redirects users to attacker-controlled sites to perform phishing or credential theft. The vulnerability was patched in Directus 11.14.0 (npm package) and @directus/api 32.1.1; the fix involves validation of the relay state redirect target against an allowlist.
Affected products
- Directus directus < 11.14.0
- Directus @directus/api < 32.1.1
Timeline
- 2026-01-06: disclosed: Advisory published GHSA-3573-4c68-g8cc
- 2026-01-06: patched: Patch released: directus 11.14.0 and @directus/api 32.1.1