CVE-2024-45596: OpenID and OAuth2 Session Caching Vulnerability in Directus

directus Updated 02 Oct 2025

Summary

10/09/2024

Disclosed on

CVE-2024-45596

CVE

Yes i

Fix available

High

Severity

7.4

CVSS Score

CVE-2024-45596: Session is cached for OpenID and OAuth2 if redirect is not used. Affects directus across 2 version ranges.

< 10.13.3 >= 11.0.0-rc.1, < 11.1.0

Fixed in 10.13.3 or 11.1.0, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Directus is an open-source content management system (CMS) that provides a headless API for managing and delivering content. It supports various authentication methods, including OpenID and OAuth2. These authentication methods allow users to log in to Directus using their credentials from external identity providers. However, a vulnerability exists in Directus where the session is cached for OpenID and OAuth2 if the redirect query string is not used during the authentication process. This vulnerability affects all projects using OpenID or OAuth2 without including the redirect query string.

Vulnerability Detail

The vulnerability allows an unauthenticated user to access the credentials of the last authenticated user via OpenID or OAuth2. When an unauthenticated user tries to log in via the Single Sign-On (SSO) link without the redirect query string, Directus caches the credentials of the last authenticated user. Subsequently, if the unauthenticated user tries to log in again via the SSO link, they will receive the credentials of the previous user. This occurs because Directus uses the respond middleware, which caches GET requests that meet certain conditions. However, this scenario, where an unauthenticated request returns user credentials, is not accounted for in the caching logic.

How To Fix

Latest published version: 12.5.0 as of 22 Oct 2026

npm install directus@12.5.0

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

< 10.13.3 10.13.3
```
npm install directus@10.13.3
```
>= 11.0.0-rc.1, < 11.1.0 11.1.0
```
npm install directus@11.1.0
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

As a workaround, users can manually clear the cache after each authentication request by restarting the Directus server or clearing the cache store. Additionally, users can modify the Directus source code to include the redirect query string in the caching logic for unauthenticated requests. However, it is recommended to apply the official fixes provided in the updated versions of Directus.

Conclusion

The OpenID and OAuth2 session caching vulnerability in Directus allows unauthenticated users to access the credentials of the last authenticated user. This can lead to unauthorized access to sensitive information and potential misuse of user accounts. It is crucial to update Directus to the fixed versions and ensure the inclusion of the redirect query string in the authentication URL to mitigate this vulnerability.

See every vulnerability recorded for directus →

FAQ

Which versions of Directus are affected by this vulnerability?

The vulnerability affects Directus versions prior to 10.13.3 for the 'directus' npm package and versions prior to 21.0.1 for the '@directus/api' npm package.

What is the impact of this vulnerability?

The vulnerability allows an unauthenticated user to access the credentials of the last authenticated user via OpenID or OAuth2. This can lead to unauthorized access to sensitive information and potential misuse of user accounts.

Are there any known workarounds for this vulnerability?

Yes, users can manually clear the cache after each authentication request or modify the Directus source code to include the redirect query string in the caching logic for unauthenticated requests. However, it is recommended to apply the official fixes provided in the updated versions of Directus.

How can I update Directus to the fixed version?

To update Directus, follow the instructions provided in the official Directus documentation for upgrading to the latest version. Make sure to backup your data before performing any updates.