Open Redirect
CVE-2026-35411
MEDIUM
GHSA-q75c-4gmv-mg9x
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Lifecycle Timeline
3Blast Radius
ecosystem impact- 3 npm packages depend on directus (1 direct, 2 indirect)
Ecosystem-wide dependent count for version 11.16.1.
DescriptionGitHub Advisory
Summary
Directus is vulnerable to an Open Redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation.
This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain.
Credits
Discovered by Neo by ProjectDiscovery (https://neo.projectdiscovery.io/)
AnalysisAI
Open redirect vulnerability in Directus allows unauthenticated attackers to redirect administrators to attacker-controlled URLs after 2FA setup completion via crafted /admin/tfa-setup redirect parameter. The attack leverages user interaction on the trusted Directus domain before redirecting to a malicious site, enabling phishing campaigns targeting administrators. CVSS 4.3 (low severity), no public exploit code or active exploitation confirmed.
Technical ContextAI
The vulnerability exists in Directus's 2FA setup flow (CWE-601: URL Redirection to Untrusted Site). The /admin/tfa-setup endpoint accepts a redirect query parameter that is not validated before being used in a post-setup redirect response. The affected product is the npm package 'directus' (pkg:npm/directus), a headless CMS platform. The root cause is insufficient input validation on the redirect parameter, allowing attackers to craft URLs that pass the legitimate 2FA setup page to users before redirecting them to arbitrary domains.
RemediationAI
Upgrade Directus to the patched version specified in the GitHub Advisory (GHSA-q75c-4gmv-mg9x). Consult https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x for the exact minimum patched version. As a temporary workaround pending patching, restrict access to the /admin/tfa-setup endpoint via web application firewall rules or reverse proxy to limit exposure to trusted networks, though this does not eliminate the underlying vulnerability. Administrators should review any 2FA setup completion logs for suspicious redirect parameters and be aware of phishing attempts using legitimate Directus domains.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today