CVE-2026-22032: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22032 is an open redirect vulnerability (CWE-601) in the Directus SAML authentication callback endpoint, affecting all versions of Directus prior to 11.14.0. The flaw allows unauthenticated attackers to redirect authenticated users to arbitrary external URLs by manipulating the RelayState parameter during SAML authentication. It was published on January 8, 2026, with a patch released in version 11.14.0. NVD assigns a CVSS v3.1 score of 6.1 (Medium), while the CNA (GitHub) scores it at 4.3 (Medium) (GitHub Advisory, NVD).

The root cause is an inconsistency in redirect validation logic within Directus's SAML authentication driver (api/src/auth/drivers/saml.ts). While the login initiation flow validates redirect targets against an allowlist of permitted domains using isLoginRedirectAllowed(), this validation was not applied to the SAML callback endpoint. As a result, the RelayState parameter — intended to preserve the user's original destination — is used directly in redirects without domain validation in both the success and error handling paths of the callback. The fix, introduced in commit dad9576, adds a call to isLoginRedirectAllowed(relayState, providerName) before processing the SAML response, throwing an InvalidPayloadError if the redirect target is not permitted (GitHub Advisory, Patch Commit).

Successful exploitation enables phishing attacks by redirecting users who have just completed SAML authentication to attacker-controlled sites that may mimic legitimate login pages. This can facilitate credential theft, OAuth token or authorization code harvesting through chained attacks, and malware distribution. The vulnerability does not directly impact availability or confidentiality of the Directus instance itself, but poses significant integrity and trust risks to end users, as the redirect appears to originate from a trusted Directus domain (GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires user interaction (a victim must complete the SAML authentication flow) but does not require the attacker to be authenticated. No threat actor attribution is available. The EPSS score is approximately 0.056% (0.000560), indicating a low probability of exploitation in the near term. This CVE does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog (Feedly, GitHub Advisory).

1. Identify a target Directus instance: Locate a Directus deployment running a version prior to 11.14.0 with SAML authentication enabled, using tools like Shodan or Censys to find exposed instances.
2. Craft a malicious SAML authentication URL: Construct a SAML login initiation request that includes a RelayState parameter pointing to an attacker-controlled external URL (e.g., https://attacker.com/phishing-page).
3. Deliver the malicious link: Send the crafted URL to a target user via phishing email, social engineering, or by embedding it in a web page, enticing them to click and initiate the SAML login flow.
4. User completes authentication: The victim authenticates normally through the legitimate Identity Provider (IdP). Upon successful authentication, the SAML callback endpoint processes the response without validating the RelayState value.
5. Redirect to attacker-controlled site: The victim is automatically redirected to the attacker's URL (e.g., a credential-harvesting page or malware distribution site), appearing to originate from the trusted Directus instance (GitHub Advisory, Patch Commit).

• Network: HTTP POST requests to the Directus SAML callback endpoint (e.g., /auth/login/<provider>/callback) containing a RelayState parameter with an external or unexpected domain; outbound HTTP redirects (3xx responses) from the Directus server to non-whitelisted external domains following SAML authentication.
• Logs: Directus access logs showing SAML callback requests where the RelayState value contains an external URL not matching configured allowed domains; repeated SAML callback requests from the same source IP with varying RelayState values (indicating probing or automated exploitation attempts).
• Application: Error log entries referencing InvalidPayloadError for RelayState validation failures (on patched systems, indicating attempted exploitation).

The primary remediation is to upgrade Directus to version 11.14.0 or later, which applies redirect validation to the SAML callback endpoint (GitHub Advisory, Patch Commit). If immediate patching is not feasible, organizations should implement network-level controls or a web application firewall (WAF) rule to inspect and restrict RelayState values in SAML callback requests to expected domains. Additionally, educating users to verify redirect destinations after authentication flows can reduce the risk of successful phishing via this vector.

The vulnerability was reported by security researchers im-soohyun and Seeunsama, credited in the GitHub Security Advisory (GitHub Advisory). The Directus maintainer team responded promptly, publishing the advisory and patch on January 6–8, 2026. No significant broader media coverage or notable community debate has been identified beyond standard vulnerability tracking and aggregation sites.