GHSA-jr94-gj3h-c8rf Directus Vulnerable to User Enumeration via Password Reset Timing Attack

• npm directus: < 11.14.1 → fixed in 11.14.1 • npm @directus/api: < 32.2.0 → fixed in 32.2.0

Summary A timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. Details The password reset endpoint implements a timing protection mechanism to prevent user enumeration; however, URL validation executes before the timing protection is applied. This allows an attacker to distinguish between valid and invalid user accounts based on response timing differences. Impact This vulnerability violates user privacy and may facilitate targeted phishing attacks by allowing attackers to confirm the existence of user accounts.