Executive brief
Directus, a platform for managing SQL database content, contains a security flaw in its login system. An attacker can create a malicious link that, after a user successfully logs in, automatically redirects them to a fraudulent website. This can be used in phishing attacks to steal user credentials or sensitive tokens by making the malicious site appear as a legitimate part of the login process.
Technical details
An open redirect vulnerability exists in Directus due to a parser differential in the 'isLoginRedirectAllowed' function. The server-side validation logic fails to correctly identify malformed URLs containing backslashes as external, while modern browsers normalize these same patterns into external domain references. This allows an unauthenticated attacker to craft a URL that bypasses the redirect allow-list. The flaw is particularly impactful in OAuth2 and SAML SSO flows, where a user can be silently redirected to an attacker-controlled domain immediately after successful authentication. This can be leveraged for phishing or to capture authorization codes and tokens. The issue is resolved in version 11.16.1.
Affected products
- Directus Directus < 11.16.1
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-06: disclosed: CVE published to NVD
- 2026-04-06: patched: Fix released in version 11.16.1