CVE-2024-28239

CVE-2024-28239 is an open redirect vulnerability affecting Directus versions prior to 10.10.0, where the authentication API's 'redirect' parameter can be manipulated to redirect users to arbitrary malicious sites after a successful login. This vulnerability has a CVSS score of 4.3 (MEDIUM), indicating a network-based attack with low complexity, requiring user interaction, and potentially leading to information disclosure through phishing. While no credentials are directly passed, users could be tricked into revealing sensitive information on a spoofed site. There is currently no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.