{"id":"CVE-2024-28239","aliases":["GHSA-fr3w-2p22-6w7p"],"url":"https://o3.security/vulnerability/CVE-2024-28239","summary":"URL Redirection to Untrusted Site in OAuth2/OpenID in directus","details":"### Summary\nThe authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL https://docs.directus.io/reference/authentication.html#login-using-sso-providers /auth/login/google?redirect for example.\n\n### Details\nThere's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`, which I think is here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L394. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message \"Your password needs to be updated\" to phish out the current password.\n\n### PoC\nTurn on any auth provider in Directus instance. Form a link to `directus-instance/auth/login/:provider_id?redirect=http://malicious-fishing-site.com`, login and get taken to malicious-site. Tested on the `ory` OAuth2 integration.\n\n### Impact\nUsers who login via OAuth2 into Directus.","published":"2024-03-12T20:23:37.857Z","modified":"2026-08-12T03:51:11.047566141Z","cvss":{"score":5.4,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"directus","fixedVersion":"10.10.0"}],"fix":{"url":"https://github.com/directus/directus/commit/5477d7d61babd7ffc2f835d399bf79611b15b203","label":"directus/directus@5477d7d"},"references":[{"type":"WEB","url":"https://docs.directus.io/reference/authentication.html#login-using-sso-providers"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28239.json"},{"type":"ADVISORY","url":"https://github.com/directus/directus/security/advisories/GHSA-fr3w-2p22-6w7p"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28239"},{"type":"FIX","url":"https://github.com/directus/directus/commit/5477d7d61babd7ffc2f835d399bf79611b15b203"},{"type":"PACKAGE","url":"https://github.com/directus/directus"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:11.047566141Z"}}