Open Redirect in Directus
CVE-2026-35411
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. This vulnerability is fixed in 11.16.1.
Vulnerability class: Open Redirect
EPSS: 0.003 (17.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N.
Affected products
- Directus — versions < 11.16.1
- Monospace Directus
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-35411?
- CVE-2026-35411 is a medium-severity vulnerability in Directus, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 4.3/10. Published 2026-04-06.
- How severe is CVE-2026-35411?
- Medium severity. CVSS v3 base score is 4.3 out of 10.