GitHub Advisoryadvisory · npm

GHSA-q75c-4gmv-mg9x Directus: Open Redirect in Admin 2FA Setup Page

MEDIUM Published 2026-04-04 Modified 2026-04-07 Official page ↗
Aliases
CVE-2026-35411
Ecosystem
npm
Packages
directus
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-04-04

Affected packages

• npm directus: < 11.16.1 → fixed in 11.16.1

Description

Summary Directus is vulnerable to an Open Redirect via the redirect query parameter on the `/admin/tfa-setup` page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the `redirect` parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. Credits Discovered by Neo by ProjectDiscovery (https://neo.projectdiscovery.io/)

Related

Alias · CVE (1)

  • CVE-2026-35411 Directus is a real-time API and App dashboard for managing SQL database content. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References