CVE-2026-35410

VULNERABILITY OVERVIEW Directus versions prior to 11.16.1 contain an open redirect vulnerability in the login redirection logic. The isLoginRedirectAllowed function fails to properly validate malformed URLs, enabling attackers to bypass the redirect allow-list and redirect authenticated users to arbitrary external domains. This affects the widely-used real-time API and database management dashboard product. SEVERITY ASSESSMENT The vulnerability carries a CVSS 3.1 score of 6.1 (Medium), with a network-based attack vector requiring no privileges but necessitating user interaction. Attack complexity is low, making exploitation straightforward. The impact is limited to confidentiality and integrity concerns with no availability impact, as attackers can only redirect authenticated users to external sites rather than compromise system functionality or data directly. EXPLOITATION STATUS This vulnerability shows minimal active exploitation risk. It is not currently on the Known Exploited Vulnerabilities list, and the EPSS score of 0.00018 indicates extremely low probability of exploitation in the wild relative to other CVEs. No publicly disclosed exploit code is currently widespread, and community attention appears limited given the low threat indicators. Organizations should prioritize patching to version 11.16.1, but this is not an immediate critical threat.