CVE-2026-35408: Directus Missing Cross-Origin Opener Policy Vulnerability
Summary
CVE-2026-35408: Directus: Missing Cross-Origin Opener Policy. Affects directus versions < 11.17.0. Fixed in 11.17.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source data platform that provides a headless CMS and API for managing content. It allows users to create, manage, and distribute content across various applications. The platform supports Single Sign-On (SSO) for user authentication, which simplifies the login process by allowing users to authenticate using third-party identity providers like Google and Discord. However, a recent vulnerability has been identified that affects the security of the SSO login process.
Vulnerability Detail
The vulnerability arises from the absence of a Cross-Origin-Opener-Policy (COOP) HTTP response header on Directus's SSO login pages. This oversight allows a malicious cross-origin window to access and manipulate the window object of the Directus login page. An attacker can exploit this vulnerability to intercept the OAuth authorization flow, redirecting it to an attacker-controlled OAuth client. This could result in the victim unknowingly granting access to their authentication provider account, leading to unauthorized access or account takeover.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.17.0
This is the first release that contains the fix.
npm install directus@11.17.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, users can mitigate the vulnerability by configuring their reverse proxy or web server to add the following HTTP response header to all Directus responses: Cross-Origin-Opener-Policy: same-origin. This can typically be done in the server configuration files, such as Nginx or Apache.
Conclusion
The missing Cross-Origin-Opener-Policy in Directus's SSO login pages poses a significant security risk, allowing attackers to exploit the OAuth authorization flow. Users are strongly encouraged to upgrade to the patched version or implement the recommended workaround to safeguard their applications.
See every vulnerability recorded for directus →
FAQ
The Cross-Origin-Opener-Policy is an HTTP response header that controls how a document can interact with cross-origin documents. It helps prevent attacks by isolating browsing contexts.
An attacker could gain unauthorized access to a victim's third-party identity provider account and potentially take over their Directus account.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
You can mitigate the vulnerability by adding the Cross-Origin-Opener-Policy header to your server responses as a temporary measure.
The CVSS score for this vulnerability is 8.7, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
