CVE-2026-22032
published 2026-01-08CVE-2026-22032: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the…
PriorityP434medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.20%
9.5th percentile
Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| directus | api | >= 0 < 32.1.1 | 32.1.1 |
| directus | directus | < 11.14.0 | 11.14.0 |
| directus | directus | >= 0 < 11.14.0 | 11.14.0 |
| monospace | directus | < 11.14.0 | 11.14.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Directus has open redirect in SAML
osv·2026-01-06
CVE-2026-22032 [MEDIUM] Directus has open redirect in SAML
Directus has open redirect in SAML
## Security Advisory: Open Redirect in Directus SAML Authentication
### Summary
An open redirect vulnerability exists in the Directus SAML authentication callback endpoint. The `RelayState` parameter is used in redirects without proper validation against an allowlist of permitted domains.
### Vulnerability Description
During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion.
The vulnerability is present in both the s
GHSA
Directus has open redirect in SAML
ghsa·2026-01-06
CVE-2026-22032 [MEDIUM] CWE-601 Directus has open redirect in SAML
Directus has open redirect in SAML
## Security Advisory: Open Redirect in Directus SAML Authentication
### Summary
An open redirect vulnerability exists in the Directus SAML authentication callback endpoint. The `RelayState` parameter is used in redirects without proper validation against an allowlist of permitted domains.
### Vulnerability Description
During SAML authentication, the `RelayState` parameter is intended to preserve the user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion.
The vulnerability is present in both the s
No detection rules found.
No public exploits indexed.
2026-01-08
Published