Skip to content

Commit dd7d806

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-cf45-hxwj-4cfj GHSA-q75c-4gmv-mg9x GHSA-wxwm-3fxv-mrvx
1 parent 9fb05af commit dd7d806

3 files changed

Lines changed: 173 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/04/GHSA-cf45-hxwj-4cfj/GHSA-cf45-hxwj-4cfj.json‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cf45-hxwj-4cfj",
4+
"modified": "2026-04-04T06:09:55Z",
5+
"published": "2026-04-04T06:09:55Z",
6+
"aliases": [
7+
"CVE-2026-35410"
8+
],
9+
"summary": "Directus: Open Redirect via Parser Bypass in OAuth2/SAML Authentication Flow",
10+
"details": "### Summary\n\nAn open redirect vulnerability exists in the login redirection logic. The `isLoginRedirectAllowed` function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication.\n\n### Details\n\nA parser differential exists between the server-side URL validation logic and how modern browsers interpret URL path segments containing backslashes. Specifically, certain URL patterns are incorrectly classified as safe relative paths by the server, but are normalized by browsers into external domain references.\n\nThis is particularly impactful in SSO authentication flows (e.g., OAuth2 providers), where an attacker can craft a login URL that redirects the victim to an attacker-controlled site immediately after successful authentication, without any visible indication during the login process.\n\n### Impact\n\n- **Phishing:** Users may be silently redirected to attacker-controlled sites impersonating legitimate services after authenticating.\n- **Credential/token theft:** The redirect can be chained to capture OAuth tokens or authorization codes.\n- **Trust erosion:** Users lose confidence in the application after being redirected to unexpected domains post-login.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "directus"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "11.16.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/directus/directus"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-184",
51+
"CWE-20",
52+
"CWE-601"
53+
],
54+
"severity": "MODERATE",
55+
"github_reviewed": true,
56+
"github_reviewed_at": "2026-04-04T06:09:55Z",
57+
"nvd_published_at": null
58+
}
59+
}

‎advisories/github-reviewed/2026/04/GHSA-q75c-4gmv-mg9x/GHSA-q75c-4gmv-mg9x.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q75c-4gmv-mg9x",
4+
"modified": "2026-04-04T06:08:26Z",
5+
"published": "2026-04-04T06:08:26Z",
6+
"aliases": [
7+
"CVE-2026-35411"
8+
],
9+
"summary": "Directus: Open Redirect in Admin 2FA Setup Page",
10+
"details": "### Summary\n\nDirectus is vulnerable to an Open Redirect via the redirect query parameter on the `/admin/tfa-setup` page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the `redirect` parameter without any validation.\n\nThis vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain.\n\n### Credits\nDiscovered by Neo by ProjectDiscovery (https://neo.projectdiscovery.io/)",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "directus"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "11.16.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/directus/directus"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-601"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-04T06:08:26Z",
55+
"nvd_published_at": null
56+
}
57+
}

‎advisories/github-reviewed/2026/04/GHSA-wxwm-3fxv-mrvx/GHSA-wxwm-3fxv-mrvx.json‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-wxwm-3fxv-mrvx",
4+
"modified": "2026-04-04T06:10:27Z",
5+
"published": "2026-04-04T06:10:27Z",
6+
"aliases": [
7+
"CVE-2026-35413"
8+
],
9+
"summary": "Directus: GraphQL Schema SDL Disclosure Setting",
10+
"details": "## Summary\n\nWhen `GRAPHQL_INTROSPECTION=false` is configured, Directus correctly blocks standard GraphQL introspection queries (`__schema`, `__type`). However, the `server_specs_graphql` resolver on the `/graphql/system` endpoint returns an equivalent SDL representation of the schema and was not subject to the same restriction. This allowed the introspection control to be bypassed, exposing schema structure (collection names, field names, types, and relationships) to unauthenticated users at the public permission level, and to authenticated users at their permitted permission level.\n\n## Impact\n\nAdministrators who set `GRAPHQL_INTROSPECTION=false` to hide schema structure from clients would have had a false sense of security, as equivalent schema information remained accessible via the SDL endpoint without authentication.\n\n## Credit\n\nThis vulnerability was discovered and reported by [bugbunny.ai](https://bugbunny.ai).",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "directus"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "11.16.1"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
38+
"references": [
39+
{
40+
"type": "WEB",
41+
"url": "https://github.com/directus/directus/security/advisories/GHSA-wxwm-3fxv-mrvx"
42+
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/directus/directus"
46+
}
47+
],
48+
"database_specific": {
49+
"cwe_ids": [
50+
"CWE-200"
51+
],
52+
"severity": "MODERATE",
53+
"github_reviewed": true,
54+
"github_reviewed_at": "2026-04-04T06:10:27Z",
55+
"nvd_published_at": null
56+
}
57+
}

0 commit comments

Comments
 (0)