CVE-2025-30351

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.10.0 and prior to version 11.5.0, a suspended user can use the token generated in session auth mode to access the API despite their status. This happens because there is a check missing in `verifySessionJWT` to verify that a user is actually still active and allowed to access the API. One can extract the session token obtained by, e.g. login in to the app while still active and then, after the user has been suspended continue to use that token until it expires. Version 11.5.0 patches the issue.

• CWE-672

• https://github.com/directus/directus/commit/ef179931c55b50c110feca8404901d5633940771Patch
• https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2gExploit, Vendor Advisory
• https://github.com/directus/directus/security/advisories/GHSA-56p6-qw3c-fq2gExploit, Vendor Advisory

Published

Mar 26, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-30346Varnish Cache before 7.6.2 and Varnish Enterprise before 6.0…4.8
• CVE-2025-30347Varnish Enterprise before 6.0.13r13 allows remote attackers …7.5
• CVE-2025-30348encodeText in QDom in Qt before 6.8.0 has a complex algorith…5.3
• CVE-2025-30349Horde IMP through 6.2.27, as used with Horde Application Fra…7.2
• CVE-2025-3035By first using the AI chatbot in one tab and later activatin…5.3
• CVE-2025-30350Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2025-30352Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2025-30353Directus is a real-time API and App dashboard for managing S…7.5
• CVE-2025-30354Bruno is an open source IDE for exploring and testing APIs. …4.3
• CVE-2025-30355Synapse is an open source Matrix homeserver implementation. …7.5
• CVE-2025-30356CryptoLib provides a software-only solution using the CCSDS …9.8
• CVE-2025-30357NamelessMC is a free, easy to use & powerful website softwar…6.8