CVE-2026-35408
published 2026-04-06CVE-2026-35408: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a…
PriorityP352critical9.3CVSS 3.1
AVNACLPRNUIRSCCHIHAN
EPSS
0.17%
6.6th percentile
Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| directus | directus | < 11.17.0 | 11.17.0 |
| directus | directus | >= 0 < 11.17.0 | 11.17.0 |
| monospace | directus | < 11.17.0 | 11.17.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Directus: Missing Cross-Origin Opener Policy
ghsa·2026-04-04
CVE-2026-35408 [HIGH] CWE-346 Directus: Missing Cross-Origin Opener Policy
Directus: Missing Cross-Origin Opener Policy
## Summary
Directus's Single Sign-On (SSO) login pages lacked a `Cross-Origin-Opener-Policy` (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the `window` object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord).
## Impact
A successful attack allows the attacker to obtain an OAuth access token for the victim's third-party identity provider account. Depending on the scopes authorized, this can lead to:
- Unauthorized access to the victi
OSV
Directus: Missing Cross-Origin Opener Policy
osv·2026-04-04
CVE-2026-35408 [HIGH] Directus: Missing Cross-Origin Opener Policy
Directus: Missing Cross-Origin Opener Policy
## Summary
Directus's Single Sign-On (SSO) login pages lacked a `Cross-Origin-Opener-Policy` (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the `window` object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord).
## Impact
A successful attack allows the attacker to obtain an OAuth access token for the victim's third-party identity provider account. Depending on the scopes authorized, this can lead to:
- Unauthorized access to the victi
No detection rules found.
No public exploits indexed.
2026-04-06
Published