CVE-2024-28239: Open Redirect Vulnerability in directus
Summary
CVE-2024-28239: URL Redirection to Untrusted Site in OAuth2/OpenID in directus. Affects directus versions < 10.10.0. Fixed in 10.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS (Content Management System) that provides a user-friendly interface for managing content and data. It allows users to authenticate using OAuth2/OpenID providers such as Google. However, a vulnerability exists in the authentication API that can be exploited to perform URL redirection to an untrusted site.
Vulnerability Detail
The vulnerability arises from the redirect parameter in the authentication API, which can be abused as an open redirect vulnerability. When a user attempts to log in via the API URL, such as /auth/login/google?redirect, an attacker can manipulate the redirect parameter to redirect the user to a malicious site. Although the attacker cannot obtain the user's credentials, they can create a phishing site that mimics an error message, tricking the user into revealing their current password.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.10.0
This is the first release that contains the fix.
npm install directus@10.10.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, users can mitigate the risk by being cautious when clicking on login links and verifying the URL before entering their credentials.
Conclusion
The open redirect vulnerability in Directus can lead to users being redirected to malicious sites, potentially exposing them to phishing attacks. It is crucial to upgrade to version 10.10.0 or later to mitigate this vulnerability. For further assistance with vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for directus →
FAQ
Directus is an open-source headless CMS that provides a user-friendly interface for managing content and data.
An open redirect vulnerability occurs when a web application allows external input to control the destination of a redirect. Attackers can exploit this vulnerability to redirect users to malicious sites.
OAuth2/OpenID is a protocol that allows users to authenticate and authorize applications without sharing their credentials. It is commonly used for single sign-on (SSO) functionality.
No, the attacker cannot directly obtain user credentials through this vulnerability. However, they can create a phishing site to trick users into revealing their current password.
To protect your Directus instance, make sure to upgrade to version 10.10.0 or later. Additionally, educate your users about phishing attacks and encourage them to verify the URL before entering their credentials.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
