Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Or…

Published:

5 april 2026 om 22:00:00

Alert date:

6 april 2026 om 23:04:16

Source:

nvd.nist.gov

Web Technologies, Identity & Access

Directus versions prior to 11.17.0 contain a vulnerability in Single Sign-On (SSO) login pages that lack Cross-Origin-Opener-Policy (COOP) HTTP response headers. This allows malicious cross-origin windows to access and manipulate the Directus login page window object. Attackers can exploit this to intercept and redirect OAuth authorization flows to attacker-controlled OAuth clients. Victims unknowingly grant access to their authentication provider accounts including Google and Discord. The vulnerability enables OAuth flow hijacking through cross-origin window manipulation. This issue is fixed in Directus version 11.17.0.

Technical details

Mitigation steps:

Affected products:

Directus