PT-2026-30328 · Npm · Directus

Published 2026-04-04 · Updated 2026-04-04 · CVE-2026-35411

OSV

CVSS v3.1

4.3

Medium

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Summary

Directus is vulnerable to an Open Redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation.

This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain.

Credits

Discovered by Neo by ProjectDiscovery (https://neo.projectdiscovery.io/)

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-35411

GHSA-Q75C-4GMV-MG9X

Affected Products

Directus

References · 3

• https://osv.dev/vulnerability/GHSA-q75c-4gmv-mg9x · Vendor Advisory
• https://github.com/directus/directus · Note
• https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x · Note