EUVD-2026-19518
GHSA-cf45-hxwj-4cfj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
4Blast Radius
ecosystem impact- 3 npm packages depend on directus (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 11.16.1.
DescriptionGitHub Advisory
Summary
An open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication.
Details
A parser differential exists between the server-side URL validation logic and how modern browsers interpret URL path segments containing backslashes. Specifically, certain URL patterns are incorrectly classified as safe relative paths by the server, but are normalized by browsers into external domain references.
This is particularly impactful in SSO authentication flows (e.g., OAuth2 providers), where an attacker can craft a login URL that redirects the victim to an attacker-controlled site immediately after successful authentication, without any visible indication during the login process.
Impact
- Phishing: Users may be silently redirected to attacker-controlled sites impersonating legitimate services after authenticating.
- Credential/token theft: The redirect can be chained to capture OAuth tokens or authorization codes.
- Trust erosion: Users lose confidence in the application after being redirected to unexpected domains post-login.
AnalysisAI
Open redirect vulnerability in Directus login redirection logic allows unauthenticated attackers to bypass URL allow-list validation through malformed URLs containing backslashes, silently redirecting authenticated users to arbitrary external domains. The vulnerability exploits a parser differential between server-side validation and browser URL normalization, creating a phishing vector particularly dangerous in SSO/OAuth2 flows where attackers can capture authentication tokens without visible user indication. CVSS 6.1 reflects moderate real-world risk due to user interaction requirement and limited direct confidentiality impact, but the attack chain (authentication + silent redirect + credential theft) presents meaningful business risk.
Technical ContextAI
The vulnerability resides in Directus's isLoginRedirectAllowed function, which validates redirect URLs against an allow-list to prevent open redirect attacks. The root cause (CWE-20: Improper Input Validation) stems from a parser differential: the server-side validation logic incorrectly classifies certain URL patterns as safe relative paths, while RFC 3986-compliant browsers normalize backslash-containing URL segments into absolute external references. Specifically, URLs like /auth/login?redirect=\\attacker.com are treated as relative paths by the validation logic but resolved as external URLs by browsers during the HTTP redirect. This affects the npm package directus (CPE: pkg:npm/directus), suggesting the vulnerability exists in Directus's Node.js/JavaScript authentication middleware.
RemediationAI
Apply the vendor-released patch by upgrading Directus to the patched version specified in the official GitHub Security Advisory (https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj and https://github.com/advisories/GHSA-cf45-hxwj-4cfj). The patch corrects the isLoginRedirectAllowed function to properly reject URLs containing backslashes or other patterns that browsers normalize into external domains. In the interim, implement additional validation: deny redirect URLs containing backslashes or non-ASCII characters, enforce strict URL parsing using browser-compatible URL parsing libraries (e.g., the URL standard), and configure Content-Security-Policy headers to restrict redirect destinations. For SSO integrations, consider adding user-facing confirmation before redirects post-authentication, and log all redirect attempts for security monitoring.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Same weakness CWE-20 – Improper Input Validation
View allShare
External POC / Exploit Code
Leaving vuln.today