CVE-2026-22032 json
Directus has open redirect in SAML
published 2026-01-06 10 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-0980 , GHSA-3573-4c68-g8cc
- cvss
- 4.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch.
Patch / fix
- npm directus 11.14.0
- npm @directus/api 32.1.1
- monospace directus 11.14.0
- rangerstudio directus 11.14.0
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 10 mo ago
Exploit prediction
0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| GitHub | 3.1 | 4.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| NVD | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | directus | <11.14.0 |
11.14.0 |
| npm | @directus/api | <32.1.1 |
32.1.1 |
Affected products
- directus directus
Classification
- Weakness
-
- CWE-601 URL Redirection to Untrusted Site
References
-
github.com
/directus/directus/commit/dad9576ea9362905cc4de8028d3877caff36dc23
web, patch
-
github.com
/directus/directus/security/advisories/GHSA-3573-4c68-g8cc
web, third-party-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-22032
advisory
-
github.com
/directus/directus
package
Sources
- CVE List CVE-2026-22032
- GitHub Advisory GHSA-3573-4c68-g8cc
- NVD CVE-2026-22032
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.