PT-2026-30328 · Directus · Directus

Akokonunes + 2 · Published 2026-04-04 · Updated 2026-04-06 · CVE-2026-35411

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Directus versions prior to 11.16.1

Description Directus is susceptible to an open redirect issue through the redirect parameter on the /admin/tfa-setup page. An administrator who has not configured Two-Factor Authentication (2FA) may be redirected to an attacker-controlled URL after completing the 2FA setup process, as the application lacks validation of the redirect destination. This could be leveraged in phishing attacks targeting Directus administrators.

Recommendations Update to version 11.16.1 or later.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-35411

GHSA-Q75C-4GMV-MG9X

Affected Products

Directus

References · 5

• https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35411 · Security Note
• https://osv.dev/vulnerability/GHSA-q75c-4gmv-mg9x · Vendor Advisory
• https://github.com/directus/directus · Note
• https://twitter.com/CVEnew/status/2041282872716427569 · Twitter Post