CVE-2026-35408
Cross-Origin Window Manipulation in Directus SSO OAuth Flow
Publication date: 2026-04-06
Last updated on: 2026-04-20
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| monospace | directus | to 11.17.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Directus versions prior to 11.17.0, specifically its Single Sign-On (SSO) login pages. These pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header, which normally helps isolate the page from other origins.
Without the COOP header, a malicious cross-origin window that opens the Directus login page can still access and manipulate the window object of that page.
An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account, such as Google or Discord.
This vulnerability was fixed in Directus version 11.17.0.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to your authentication provider accounts by attackers.
Specifically, an attacker can intercept and redirect the OAuth authorization flow, causing you to unknowingly grant access to your accounts (e.g., Google, Discord) to the attacker.
This can result in compromise of your personal or organizational accounts, potentially leading to data breaches or unauthorized actions performed under your identity.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade Directus to version 11.17.0 or later, where the issue is fixed by adding the Cross-Origin-Opener-Policy (COOP) HTTP response header to the Single Sign-On (SSO) login pages.