CVE-2024-45596

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0.

• CWE-524

• https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91bPatch
• https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52Patch
• https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8Exploit, Vendor Advisory

Published

Sep 10, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45590body-parser is Node.js body parsing middleware. body-parser …7.5
• CVE-2024-45591XWiki Platform is a generic wiki platform. The REST API expo…5.3
• CVE-2024-45592auditor-bundle, formerly known as DoctrineAuditBundle, integ…6.1
• CVE-2024-45593Nix is a package manager for Linux and other Unix systems. A…8.8
• CVE-2024-45594Decidim is a participatory democracy framework. The meeting …5.4
• CVE-2024-45595D-Tale is a visualizer for Pandas data structures. Users hos…9.8
• CVE-2024-45597Pluto is a superset of Lua 5.4 with a focus on general-purpo…5.3
• CVE-2024-45598Cacti is an open source performance and fault management fra…4.9
• CVE-2024-45599Cursor is an artificial intelligence code editor. Prior to v…3.8
• CVE-2024-4560The Kognetiks Chatbot for WordPress plugin for WordPress is …9.8
• CVE-2024-45600Fields is a GLPI plugin that allows users to add custom fiel…7.7
• CVE-2024-45601Mesop is a Python-based UI framework designed for rapid web …7.5