Directus Lacks Session Tokens Invalidation
Summary
CVE-2024-34709: Directus Lacks Session Tokens Invalidation. Affects directus versions >= 10.10.0, < 10.11.0. Fixed in 10.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source headless CMS (Content Management System) that provides a user-friendly interface for managing content and databases. It allows developers to create custom database schemas and provides an API for accessing and manipulating data. Directus uses session tokens for authentication and authorization purposes.
Vulnerability Detail
The vulnerability in Directus involves the lack of session tokens invalidation. When a user logs out, the session token is destroyed and the associated cookie is deleted. However, the token itself remains valid until its expiration time, which is set to 1 day by default. This means that if an attacker captures the session token, they can continue to use it even after the user has logged out. The token acts as a long-lived unrevokable stateless token instead of a stateful session token. This vulnerability can potentially enable certain attacks, especially in shared computer environments where an attacker can access the browser's history to obtain a valid session token.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.11.0
This is the first release that contains the fix.
npm install directus@10.11.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The lack of session tokens invalidation in Directus can lead to unauthorized access to a Directus instance if an attacker obtains a valid session token. It is important to update to the latest version of the Directus package (10.11.0) to ensure the fix for this vulnerability is applied. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for directus →
FAQ
Directus is an open-source headless CMS that provides a user-friendly interface for managing content and databases.
A session token is a piece of data used for authentication and authorization in web applications. It is typically generated when a user logs in and is used to identify and validate the user's session.
The lack of session token invalidation in Directus allows captured session tokens to remain valid even after the user has logged out. This can potentially enable unauthorized access to a Directus instance if an attacker obtains a valid session token.
The default expiration time for session tokens in Directus is 1 day.
Yes, the vulnerability has been fixed in version 10.11.0 of the Directus package.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
