CVE-2025-53886: Directus Exposes Session Credentials in Flow Logs
Summary
CVE-2025-53886: Directus tokens are not redacted in flow logs, exposing session credentials to all admin. Affects directus versions < 11.9.0. Fixed in 11.9.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Directus is an open-source headless CMS that allows users to manage and deliver content through APIs. It provides a flexible and customizable platform for developers and content creators, enabling them to build applications with ease. However, a vulnerability has been identified in the way Directus handles logging for Flows, particularly when using the WebHook trigger.
Vulnerability Detail
The vulnerability arises from the logging mechanism in Directus Flows, where all incoming request details, including sensitive security data such as access and refresh tokens stored in cookies, are logged. This can lead to serious security issues, as malicious admins with access to these logs can hijack user sessions within the token expiration time, compromising user accounts and sensitive information.
How To Fix
Latest published version: 12.5.0 as of 22 Oct 2026
npm install directus@12.5.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.9.0
This is the first release that contains the fix.
npm install directus@11.9.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the WebHook trigger in Directus Flows until the package is updated. This will prevent sensitive data from being logged while you work on applying the patch.
Conclusion
In summary, CVE-2025-53886 is a significant vulnerability in Directus that can expose sensitive session credentials through flow logs. It is crucial to update to the patched version 11.9.0 to mitigate this risk. Users are encouraged to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for directus →
FAQ
CVE-2025-53886 is a vulnerability in Directus that exposes session credentials in flow logs, potentially allowing malicious admins to hijack user sessions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If you cannot update Directus right away, consider disabling the WebHook trigger in Flows to prevent sensitive data from being logged.
The CVSS score of this vulnerability is 4.5, indicating a moderate severity level.
More information can be found in the advisory database at GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-f24x-rm6g-3w5v/GHSA-f24x-rm6g-3w5v.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for directus.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
