PT-2026-2139 · Directus · Directus

Im-Soohyun + 1 · Published 2026-01-06 · Updated 2026-01-20 · CVE-2026-22032

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.14.0

Description Directus is a real-time API and App dashboard for managing SQL database content. An open redirect exists in the Directus SAML authentication callback endpoint. The RelayState parameter, intended to preserve the user's original destination, is not validated for redirect targets during the callback process, allowing an attacker to redirect users to an arbitrary external URL upon authentication completion. This can be exploited without authentication and is present in both success and error handling paths of the callback.

Recommendations Versions prior to 11.14.0 should be updated to version 11.14.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-22032

GHSA-3573-4C68-G8CC

Affected Products

Directus

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22032.json · Exploit
• https://github.com/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-22032 · Security Note
• https://osv.dev/vulnerability/GHSA-3573-4c68-g8cc · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22032 · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/security/advisories/GHSA-3573-4c68-g8cc · Note
• https://twitter.com/CVEnew/status/2009277043259723911 · Twitter Post
• https://t.me/CVEtracker/41728 · Telegram Post
• https://t.me/cveNotify/149312 · Telegram Post