CVE-2024-39896: Directus Allows Single Sign-On User Enumeration
Summary
CVE-2024-39896: Directus Allows Single Sign-On User Enumeration. Affects directus versions >= 9.11, < 10.13.0. Fixed in 10.13.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Directus is an open-source content management system (CMS) that provides a user-friendly interface for managing databases. It allows users to create, edit, and delete content in a structured manner. Directus supports Single Sign-On (SSO) authentication, which enables users to log in using their existing credentials from external identity providers. This feature enhances user convenience and security. However, a vulnerability in Directus allows for user enumeration when using SSO in combination with local authentication.
Vulnerability Detail
The vulnerability arises from the error messages thrown by Directus when attempting to log in with a valid or invalid email address. If an email address exists in Directus and belongs to a known SSO provider, the system will display an error indicating that the user belongs to another provider. This behavior can be exploited to enumerate existing SSO users in the Directus instance. An attacker can use this information to identify valid email addresses associated with SSO accounts, potentially facilitating further attacks or unauthorized access.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.13.0
This is the first release that contains the fix.
npm install directus@10.13.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If SSO is the only authentication method used in Directus, the vulnerability can be mitigated by disabling local login. This can be achieved by setting the environment variable AUTH_DISABLE_DEFAULT to "true". However, this workaround should be used with caution, as it may limit the flexibility of authentication options.
Conclusion
The vulnerability in Directus allows for user enumeration when using SSO in combination with local authentication. It is crucial for Directus users to update their installations to version 10.13.0 or later to fix this vulnerability. Additionally, if SSO is the sole authentication method, disabling local login can provide a workaround. By addressing this vulnerability, the security and integrity of Directus instances can be enhanced.
See every vulnerability recorded for directus →
FAQ
Directus is an open-source content management system that provides a user-friendly interface for managing databases.
Single Sign-On authentication allows users to log in to multiple systems or applications using a single set of credentials from an external identity provider.
The vulnerability allows an attacker to enumerate existing SSO users in a Directus instance, potentially facilitating further attacks or unauthorized access.
The vulnerability has been fixed in Directus version 10.13.0. It is recommended to upgrade to this version or any subsequent releases.
Yes, if SSO is the only authentication method used, the vulnerability can be mitigated by disabling local login through the AUTH_DISABLE_DEFAULT environment variable.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
