CVE-2026-35411

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.16.1, Directus is vulnerable to an open redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation. This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain. This vulnerability is fixed in 11.16.1.

• CWE-601

• https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9xVendor Advisory

Published

Apr 6, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-35406Aardvark-dns is an authoritative dns server for A/AAAA conta…7.5
• CVE-2026-35407Saleor is an e-commerce platform. From 2.10.0 to before 3.23…6.5
• CVE-2026-35408Directus is a real-time API and App dashboard for managing S…9.3
• CVE-2026-35409Directus is a real-time API and App dashboard for managing S…7.7
• CVE-2026-3541Inappropriate implementation in CSS in Google Chrome prior t…8.8
• CVE-2026-35410Directus is a real-time API and App dashboard for managing S…6.1
• CVE-2026-35412Directus is a real-time API and App dashboard for managing S…8.1
• CVE-2026-35413Directus is a real-time API and App dashboard for managing S…5.3
• CVE-2026-35414OpenSSH before 10.3 mishandles the authorized_keys principal…8.1
• CVE-2026-35415Integer overflow or wraparound in Windows Storage Spaces Con…7.8
• CVE-2026-35416Access of resource using incompatible type ('type confusion'…7
• CVE-2026-35417Use after free in Windows Win32K - GRFX allows an authorized…7.8