CVE-2026-35410: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35410 is an open redirect vulnerability in Directus, a real-time API and App dashboard for managing SQL database content. The flaw exists in the login redirection logic, where the isLoginRedirectAllowed function fails to correctly identify certain malformed URLs as external, allowing attackers to bypass the redirect allow-list and send authenticated users to arbitrary external domains. It affects all Directus (npm) versions prior to 11.16.1 and was published on April 2, 2026, with a patch released in version 11.16.1. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (GitHub Advisory, Directus Advisory).

The root cause is a parser differential between the server-side URL validation logic and how modern browsers interpret URL path segments containing backslashes (CWE-20, CWE-184, CWE-601). Certain URL patterns — specifically those using backslashes in path segments — are incorrectly classified as safe relative paths by the server's isLoginRedirectAllowed function, but are normalized by browsers into external domain references. This bypass is particularly impactful in SSO authentication flows (OAuth2/SAML), where an attacker can craft a malicious login URL that silently redirects the victim to an attacker-controlled site immediately after successful authentication. No privileges are required by the attacker, but user interaction (clicking a crafted link and completing login) is necessary (Directus Advisory, GitHub Advisory).

Successful exploitation allows attackers to silently redirect authenticated users to attacker-controlled external domains post-login, with no visible indication during the authentication process. The primary risks include phishing (users redirected to sites impersonating legitimate services), credential and OAuth token theft (the redirect can be chained to capture authorization codes or tokens from SSO flows), and erosion of user trust in the application. Availability is not impacted, but both confidentiality and integrity are affected at a low level due to potential data exposure and unauthorized redirection (Directus Advisory, GitHub Advisory).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.037% (Feedly) to 0.016% (GitHub Advisory Database), placing it in the 4th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (GitHub Advisory, Directus Advisory).

1. Reconnaissance: Identify a publicly accessible Directus instance running a version prior to 11.16.1, particularly one with OAuth2 or SAML SSO authentication enabled.
2. Craft malicious redirect URL: Construct a login URL with a redirect parameter containing a malformed URL that uses backslashes in the path segment (e.g., https://directus.example.com/auth/login?redirect=//attacker.com or a backslash-based variant such as https://directus.example.com/auth/login?redirect=/\attacker.com). The server's isLoginRedirectAllowed function will classify this as a safe relative path.
3. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or embedded link, enticing them to log in.
4. User authenticates: The victim completes the login process (including any SSO/OAuth2 flow) without any visible warning.
5. Redirect occurs: Upon successful authentication, the browser normalizes the backslash-containing URL into an external domain reference and redirects the user to the attacker-controlled site.
6. Harvest credentials or tokens: The attacker's site can capture OAuth tokens, authorization codes, or session data passed in the redirect, or present a phishing page to steal credentials (Directus Advisory, GitHub Advisory).

• Network: Outbound HTTP redirects (301/302 responses) from the Directus server to unexpected external domains following successful authentication events; unusual Location header values containing backslashes or double-slash patterns pointing to external hosts.
• Logs: Directus access logs showing login requests with redirect parameters containing backslash characters (\) or patterns like //external-domain.com; repeated login attempts from the same IP with varying malformed redirect values.
• Application: Presence of crafted login URLs with suspicious redirect query parameters in server access logs or web application firewall (WAF) logs; user-reported unexpected redirections to unknown sites after logging in.

Directus has released version 11.16.1 which fixes this vulnerability by correcting the isLoginRedirectAllowed function to properly identify malformed URLs containing backslashes as external references. All users running Directus versions prior to 11.16.1 should upgrade immediately. No configuration-based workaround has been officially documented; upgrading to 11.16.1 or later is the only recommended remediation (Directus Advisory, GitHub Advisory).

The vulnerability was reported by security researcher POV9en and published by br41nslug via the Directus GitHub security advisory process. The advisory received standard coverage from vulnerability tracking platforms including VulnDB, CVEFeed, and ENISA's EUVD. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (Directus Advisory).