CVE-2026-26185: 
JavaScript vulnerability analysis and mitigation

CVE-2026-26185 is a timing-based user enumeration vulnerability in the password reset functionality of Directus, a real-time API and App dashboard for managing SQL database content. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable account enumeration without authentication. The vulnerability affects the directus npm package before version 11.14.1 and @directus/api before version 32.2.0. It was disclosed on February 12, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, Directus Advisory).

The root cause is classified as CWE-203 (Observable Discrepancy). The password reset endpoint in api/src/services/users.ts was designed with a stall mechanism (STALL_TIME = 500ms) to prevent timing-based enumeration; however, URL validation via isUrlAllowed() was executed after the user lookup (getUserByEmail), meaning that for an invalid reset_url, the error was thrown before the stall could equalize response times for non-existent users. The fix, merged in PR #26485, reorders the logic so that URL validity is checked before the user existence lookup, ensuring the timing discrepancy is eliminated regardless of whether the user exists (Github Commit, Github Advisory). No special privileges or user interaction are required; the attack is executable by any unauthenticated network attacker.

Successful exploitation allows an unauthenticated attacker to reliably determine whether a given email address corresponds to a valid Directus user account, constituting an information disclosure affecting confidentiality. There is no direct impact on integrity or availability. The primary downstream risk is that confirmed account lists can be leveraged for targeted phishing campaigns, credential stuffing, or social engineering attacks against identified users (Github Advisory, Directus Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is approximately 0.009% (3rd percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low EPSS, the attack requires no authentication and is low-complexity, making it trivially executable by any network-accessible attacker.

1. Reconnaissance: Identify internet-facing Directus instances running versions prior to 11.14.1 using tools like Shodan or Censys, or by inspecting HTTP response headers for Directus version indicators.
2. Prepare target email list: Compile a list of candidate email addresses to test (e.g., from OSINT, LinkedIn, or common username patterns for the target organization).
3. Send crafted password reset requests: For each candidate email, send a POST request to the Directus password reset endpoint (e.g., /auth/password/request) with a deliberately invalid reset_url parameter that is not on the allow-list, along with the candidate email address.
4. Measure response times: Record the response time for each request. A response time approximately 500ms longer than the baseline indicates the email corresponds to an existing user account; a faster response indicates the user does not exist.
5. Build confirmed user list: Compile the list of confirmed valid email addresses for use in downstream attacks such as phishing, credential stuffing, or spear-phishing campaigns (Github Advisory, Github Commit).

• Network: Repeated POST requests to the Directus password reset endpoint (e.g., /auth/password/request) from a single IP or small IP range, particularly with varying email addresses and an invalid or unlisted reset_url parameter.
• Logs: API access logs showing a high volume of password reset requests with 400-level responses (invalid URL errors) interleaved with 200 or 204 responses, suggesting automated enumeration; unusual patterns of requests targeting the reset endpoint outside of normal business hours.
• Behavioral: Requests arriving in rapid succession with systematically varied email addresses but a consistent, invalid reset_url value, consistent with automated scripted enumeration rather than legitimate user activity.

Upgrade Directus to version 11.14.1 or later (npm package directus) or @directus/api version 32.2.0 or later, which reorders URL validation to occur before user lookup, eliminating the timing discrepancy (Github Advisory, Directus Release). For deployments that cannot patch immediately, implement network-level rate limiting on the password reset endpoint to slow automated enumeration attempts, and monitor for suspicious enumeration patterns in API logs. Ensuring consistent response times for all password reset outcomes at the network or reverse-proxy layer can also reduce the exploitability of this class of vulnerability.

The vulnerability was reported by security researcher DenizParlak and disclosed responsibly through GitHub's private advisory process before public release (Directus Advisory). A technical write-up titled "Clockwatching: Enumerating Directus Users via Timing Side Channels" was published on dev.to shortly after disclosure (dev.to). No significant broader media coverage or notable community controversy has been observed beyond standard vulnerability tracking and aggregation.