Open Redirect CVE-2026-35410

CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C) indicates moderate severity with network attack vector, low complexity, no privileges required, and user interaction necessary (UI:R). The user interaction requirement-users must click a crafted login link-lowers CVSS below 7.0, but the real-world risk is substantially higher than the score suggests. The vulnerability is not listed as KEV (CISA Known Exploited Vulnerabilities), and no public exploit code is referenced, indicating no confirmed active exploitation at analysis time. However, the attack is trivial to execute once a malformed URL is crafted, making proof-of-concept straightforward. The scope change (S:C) reflects cross-site impact: victims are redirected beyond the login application to attacker infrastructure. In SSVC terms, this is a high-priority finding: exploitation is straightforward (low complexity), automatable (URL crafting), and technical impact is high (phishing, token theft). The combination of low-friction exploitation, high business impact (SSO compromise, credential theft), and lack of active exploitation confirmation suggests this is a real-world priority despite moderate CVSS.

An attacker crafts a phishing email containing a malicious login link: https://victim-directus-app.com/auth/login?redirect=\\attacker.com/fake-login. The victim clicks the link, successfully authenticates with their credentials, and the server's isLoginRedirectAllowed function incorrectly classifies the backslash-prefixed URL as a relative path. The victim's browser, however, normalizes the URL to https://attacker.com/fake-login and silently redirects the authenticated user without visible indication. The attacker can then capture the victim's OAuth token from the URL fragment or use JavaScript to extract it from the authentication session, compromising the victim's account. This is particularly damaging in enterprise Directus deployments where SSO integration provides direct access to sensitive CMS content and user data.