Open Redirect CVE-2026-35411

CVSS 4.3 reflects low severity due to network attack vector, low complexity, no authentication requirement, and limited impact (integrity only-no confidentiality or availability loss). However, the attack vector (AV:N) and lack of authentication (PR:N) combined with user interaction (UI:R) make this a practical phishing vector. The real-world risk is moderate in targeted administrator phishing campaigns: an attacker can craft a legitimate-looking setup flow to build trust before redirecting to a credential harvesting page. No EPSS, KEV, or public exploit data was provided, suggesting low current exploitation probability, but the simplicity of exploitation (AC:L) and high-value targets (administrators) warrant prioritization in patching schedules.

An attacker crafts a URL like https://trusted-directus-instance.com/admin/tfa-setup?redirect=https://attacker-phishing-site.com and sends it to a Directus administrator via email or social engineering. The administrator visits the link, sees the legitimate Directus 2FA setup page hosted on the trusted domain, completes the setup process, and is automatically redirected to the attacker's phishing site (harvesting Directus credentials or other sensitive data). The attack succeeds because the initial interaction on the trusted domain builds credibility before the redirect occurs. No public exploit code is documented, but the vulnerability requires only manual URL crafting and social engineering.