PT-2026-2139 · Directus · Directus

Im-Soohyun + 1 · Publicado 2026-01-06 · Atualizado 2026-01-20 · CVE-2026-22032

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.0

Description Directus is a real-time API and App dashboard for managing SQL database content. An open redirect exists in the Directus SAML authentication callback endpoint. The RelayState parameter, intended to preserve the user's original destination, is not validated for redirect targets during the callback process, allowing an attacker to redirect users to an arbitrary external URL upon authentication completion. This can be exploited without authentication and is present in both success and error handling paths of the callback.

Recommendations Versions prior to 11.14.0 should be updated to version 11.14.0 or later.

Exploit

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2026-22032

GHSA-3573-4C68-G8CC

Produtos afetados

Directus

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22032.json · Exploit
• https://github.com/directus/directus · Nota
• https://github.com/directus/directus/security/advisories/GHSA-3573-4c68-g8cc · Nota
• https://github.com/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23 · Correção
• https://twitter.com/CVEnew/status/2009277043259723911 · Publicação no Twitter
• https://t.me/CVEtracker/41728 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-22032 · Nota de Segurança
• https://t.me/cveNotify/149312 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-3573-4c68-g8cc · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-22032 · Aviso do Fabricante