Google CVE-2026-35408

Directus SSO login pages with missing Cross-Origin-Opener-Policy (COOP) header. Attacker controls malicious cross-origin website. Victim must visit attacker's site and trigger opening of Directus login page, allowing window object manipulation to intercept OAuth flow and redirect to attacker-controlled OAuth client.

Real-world risk assessment requires balancing HIGH CVSS base score (8.7) against attack complexity constraints. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N) indicates network-exploitable unauthenticated attack with scope change and high confidentiality/integrity impact, but HIGH attack complexity. However, the UI:N rating may be misleading-successful exploitation requires victim interaction (clicking attacker link during authentication flow), suggesting CVSS may overstate ease of exploitation. Attack prerequisites include: victim must navigate from attacker-controlled origin to Directus SSO page, timing must align with active authentication attempt, and attacker needs pre-registered malicious OAuth client with victim's identity provider. No CISA KEV listing indicates no confirmed active exploitation. No EPSS data provided limits probability assessment. The Scope Changed metric reflects potential lateral impact to third-party identity provider accounts beyond Directus itself. For organizations using Google/Discord SSO with Directus, this represents genuine risk of account takeover chains. Priority should be MEDIUM-HIGH for internet-facing Directus instances with SSO enabled, particularly given simple patch availability. Technical impact enables full authentication bypass and potential account takeover, making this actionable despite attack complexity constraints.

An attacker registers a malicious OAuth client application with Google OAuth and hosts a phishing page at attacker-site.com that presents a legitimate-seeming reason to authenticate with Directus (e.g., fake collaboration invitation). When the victim clicks the link, the attacker's JavaScript opens the legitimate Directus SSO login page in a new window via window.open(). Because Directus lacks COOP headers, the attacker retains JavaScript access to the opened window object. The attacker's script monitors for the OAuth callback redirect, intercepts it, and modifies the authorization code flow to redirect to the attacker's malicious OAuth client ID instead of the legitimate Directus client. The victim completes authentication believing they're logging into Directus, but unknowingly grants the attacker's OAuth client access to their Google account with whatever scopes were requested, potentially including Gmail, Drive, or profile data access, leading to identity provider account compromise and potential Directus instance account takeover.