CVE-2026-35408: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35408 is a missing Cross-Origin-Opener-Policy (COOP) header vulnerability in Directus's Single Sign-On (SSO) login pages that enables OAuth authorization flow interception. Disclosed on April 2, 2026, by researcher br41nslug and published to the GitHub Advisory Database on April 4, 2026, it affects all Directus (npm) versions prior to 11.17.0 (GitHub Advisory). The vulnerability carries a CVSS v3.1 base score of 9.3 (Critical) per Feedly's assessment, while the GitHub Advisory Database rates it 8.7 (High) (GitHub Advisory, Feedly).

The root cause is the absence of the Cross-Origin-Opener-Policy: same-origin HTTP response header on Directus SSO login pages, classified under CWE-346 (Origin Validation Error) and CWE-693 (Protection Mechanism Failure) (GitHub Advisory). Without COOP, a malicious cross-origin window that opens the Directus login page retains a reference to the page's window object, allowing it to read and manipulate the browsing context. An attacker exploits this by luring a victim to open the Directus SSO page from an attacker-controlled origin, then using the retained window reference to intercept and redirect the OAuth authorization flow — substituting the legitimate OAuth client with an attacker-controlled one. The attack requires user interaction (victim must click a malicious link) but requires no privileges on the Directus instance (Directus Advisory).

A successful exploit allows the attacker to obtain an OAuth access token for the victim's third-party identity provider account (e.g., Google, Discord), resulting in high confidentiality and integrity impact with no availability impact (GitHub Advisory). Depending on the OAuth scopes authorized, consequences range from unauthorized access to the victim's linked identity provider account to full account takeover of the Directus instance if the attacker can authenticate using the stolen token or provider session (Directus Advisory). The scope is changed, meaning the impact extends beyond the Directus application itself to the victim's external identity provider account.

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.015% (1st percentile), indicating a low near-term probability of exploitation (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a target organization using Directus with SSO/OAuth enabled (e.g., Google or Discord login). Confirm the Directus version is below 11.17.0 by inspecting HTTP response headers or public-facing login pages.
2. Set up attacker infrastructure: Register a malicious OAuth client with the same identity provider (e.g., Google) used by the target Directus instance, configured to receive authorization codes at an attacker-controlled redirect URI.
3. Craft a malicious page: Create a web page that uses window.open() to open the victim's Directus SSO login URL (e.g., https://target-directus.example.com/auth/login/google) in a new tab or popup, retaining a JavaScript reference to the opened window object.
4. Lure the victim: Deliver the malicious page link to the victim via phishing, social engineering, or a compromised website, inducing them to click it while authenticated or about to authenticate.
5. Intercept the OAuth flow: Once the Directus login page opens, use the retained window reference from the opener page to manipulate the page's browsing context — redirecting the OAuth authorization request to the attacker-controlled OAuth client instead of the legitimate one.
6. Capture the OAuth token: The victim unknowingly completes the OAuth flow, granting the attacker's OAuth client access. The attacker receives an OAuth access token for the victim's identity provider account at their controlled redirect URI.
7. Account takeover: Use the captured token to access the victim's identity provider account or authenticate into the Directus instance, depending on the granted scopes (GitHub Advisory, Directus Advisory).

• Network: Unexpected OAuth authorization requests originating from unfamiliar client_id values in identity provider logs (e.g., Google OAuth audit logs); OAuth tokens issued to unrecognized redirect URIs not matching the legitimate Directus application.
• Logs: Directus access logs showing SSO login page requests immediately followed by OAuth redirects to external, non-Directus domains; identity provider sign-in logs showing successful OAuth grants to unknown applications from the victim's account.
• Application: New or unrecognized third-party application authorizations appearing in the victim's identity provider account (e.g., Google account's connected apps page); unexpected Directus login sessions from IP addresses inconsistent with the victim's normal usage patterns.

Upgrade Directus to version 11.17.0 or later, which adds the Cross-Origin-Opener-Policy: same-origin HTTP response header to SSO-related endpoints, severing any opener window reference (GitHub Advisory). For organizations unable to upgrade immediately, the same protection can be applied by configuring a reverse proxy or web server (e.g., nginx, Apache, Caddy) to inject the Cross-Origin-Opener-Policy: same-origin header on all Directus responses (Directus Advisory). As defense-in-depth, consider implementing PKCE (Proof Key for Code Exchange) and strict OAuth state parameter validation, and educate users about the risks of clicking untrusted links that open authentication pages (Feedly).

The Hacker Wire published a dedicated write-up on the vulnerability shortly after disclosure, covering the OAuth redirection mechanism and the missing COOP header (The Hacker Wire). The CVE was noted on social platforms including Bluesky and Mastodon, with automated CVE tracking accounts flagging the disclosure (Feedly). Community reaction has been moderate, with the primary focus on the straightforward remediation path (header addition) and the relatively low EPSS score suggesting limited immediate exploitation risk.