GitHub Advisoryadvisory · npm

GHSA-f24x-rm6g-3w5v Directus tokens are not redacted in flow logs, exposing session credentials to all admin

MEDIUM Published 2025-07-15 Modified 2025-07-15 Official page ↗
Aliases
CVE-2025-53886
Ecosystem
npm
Packages
directus
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-532
Reviewed
2025-07-15

Affected packages

• npm directus: < 11.9.0 → fixed in 11.9.0

Description

Summary When using Directus Flows with the WebHook trigger, all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Impact Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow.

Related

Alias · CVE (1)

  • CVE-2025-53886 Directus is a real-time API and App dashboard for managing SQL database content. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-532 Insertion of Sensitive Information into Log File weakness

References