CVE-2026-35411: Directus Open Redirect Vulnerability in Admin 2FA Setup Page
Summary
CVE-2026-35411: Directus: Open Redirect in Admin 2FA Setup Page. Affects directus versions < 11.16.1. Fixed in 11.16.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source data platform that provides a user-friendly interface for managing databases. It allows developers to create custom applications with ease, offering features like API generation, role-based access control, and real-time data updates. However, a vulnerability has been identified in the 2FA setup page, which could potentially expose administrators to phishing attacks.
Vulnerability Detail
The vulnerability arises from an open redirect flaw in the Directus application, specifically on the /admin/tfa-setup page. When an administrator who has not configured Two-Factor Authentication (2FA) visits a maliciously crafted URL, they are directed to the legitimate Directus 2FA setup page. After completing the setup, the application redirects the user to an attacker-controlled URL specified in the redirect parameter without any validation. This could lead to phishing attacks, as the initial interaction occurs on a trusted domain, making it difficult for users to recognize the threat.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.16.1
This is the first release that contains the fix.
npm install directus@11.16.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators should avoid clicking on untrusted links and ensure that they are accessing the 2FA setup page directly from the official Directus domain. Additionally, consider implementing additional security measures such as monitoring for unusual login attempts.
Conclusion
The CVE-2026-35411 vulnerability in Directus presents a significant risk to administrators due to its open redirect nature on the 2FA setup page. It is crucial to update to the patched version to mitigate this risk and to remain vigilant against potential phishing attempts.
See every vulnerability recorded for directus →
FAQ
An open redirect vulnerability allows an attacker to redirect users to a malicious site without their consent, often leading to phishing attacks.
You can check if your Directus installation is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to test your application.
If you cannot update immediately, avoid clicking on suspicious links and ensure that you access the 2FA setup page directly from the official Directus domain.
The main consequence is the risk of phishing attacks targeting administrators, which could lead to unauthorized access to sensitive data.
Yes, Vulert allows you to monitor for vulnerabilities using just the package-lock.json file, providing alerts in real-time without requiring installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
