CVE-2026-35411: 
JavaScript vulnerability analysis and mitigation

CVE-2026-35411 is an Open Redirect vulnerability in Directus, a real-time API and App dashboard, affecting the /admin/tfa-setup page via an unvalidated redirect query parameter. All versions of the directus npm package prior to 11.16.1 are affected. The vulnerability was discovered by Neo by ProjectDiscovery, published to the GitHub Advisory Database on April 4, 2026, and to the NVD on April 6, 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) (GitHub Advisory, Directus Advisory).

The root cause is CWE-601 (URL Redirection to Untrusted Site / Open Redirect): the application accepts a user-supplied redirect parameter on the /admin/tfa-setup page and uses it directly in a post-setup redirect without any validation or allowlist enforcement. An attacker crafts a URL pointing to the legitimate Directus 2FA setup page with a malicious redirect value (e.g., https://trusted-directus-instance.com/admin/tfa-setup?redirect=https://attacker.com). When the targeted administrator — who has not yet configured 2FA — visits this URL, they interact with the genuine Directus interface; upon completing 2FA setup, the application transparently redirects them to the attacker-controlled destination (GitHub Advisory, Directus Advisory).

The primary impact is integrity-related: an attacker can redirect Directus administrators to arbitrary external URLs after they complete a legitimate 2FA setup flow, enabling phishing attacks that harvest credentials or deliver malware under the guise of a trusted domain interaction. There is no direct confidentiality or availability impact from the redirect itself, but successful phishing of an administrator account could lead to full Directus instance compromise, unauthorized data access, and potential lateral movement within connected systems (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2026-35411. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.045% (0.000450), indicating a low near-term exploitation probability. Exploitation requires user interaction — specifically, an administrator who has not yet set up 2FA must click a crafted link — but requires no attacker privileges (GitHub Advisory).

1. Reconnaissance: Identify a Directus instance running a version prior to 11.16.1 and determine whether any administrators have not yet configured 2FA (e.g., through social engineering, leaked configuration data, or observing login prompts).
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with an attacker-controlled redirect destination, e.g., https://target-directus.example.com/admin/tfa-setup?redirect=https://attacker-phishing-site.com.
3. Deliver phishing lure: Send the crafted URL to the target administrator via email, chat, or another social engineering channel, presenting it as a legitimate request to complete 2FA setup.
4. Victim completes 2FA setup: The administrator visits the URL, sees the genuine Directus 2FA setup page on the trusted domain, and completes the enrollment process.
5. Redirect to attacker site: Upon completing setup, Directus redirects the administrator to the attacker-controlled URL without validation, where the attacker may harvest credentials, deliver malware, or conduct further phishing (GitHub Advisory, Directus Advisory).

• Network: Outbound HTTP redirects (3xx responses) from the Directus server to unexpected external domains following requests to /admin/tfa-setup; administrator browser traffic to unfamiliar domains immediately after 2FA setup completion.
• Logs: Web server or application access logs showing GET requests to /admin/tfa-setup with a redirect parameter containing an external or suspicious URL (e.g., redirect=https://[external-domain]/...); look for entries where the redirect value does not match the application's own domain.
• Application Logs: Directus application logs recording 2FA setup completions followed by redirect events to non-internal URLs.

Directus has released version 11.16.1 which patches this vulnerability by validating the redirect parameter on the /admin/tfa-setup page. All users running directus npm package versions prior to 11.16.1 should upgrade immediately. As a temporary workaround where upgrading is not immediately possible, administrators can restrict access to the /admin/tfa-setup endpoint via network-level controls (e.g., WAF rules blocking external values in the redirect parameter) and ensure all administrators complete 2FA setup promptly to eliminate the vulnerable pre-setup state (GitHub Advisory, Directus Advisory).

The vulnerability was discovered by Neo by ProjectDiscovery and responsibly disclosed to the Directus team, with the advisory published by maintainer br41nslug on April 2, 2026. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (GitHub Advisory).