Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, an open redirect vulnerability exists in the login redirection logic. The isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass redirect allow-list validation and redirect users to arbitrary external domains upon successful authentication. This vulnerability is fixed in 11.16.1.

INFO

Published Date :

2026-04-06T21:32:13.985Z

Last Modified :

2026-04-07T15:09:07.019Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-35410 vulnerability.

Vendors Products
Directus
  • Directus
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-35410.

URL Resource
https://github.com/directus/directus/security/advisories/GHSA-cf45-hxwj-4cfj cve-icon cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact