NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦
📦 npm
Not in CISA KEV
HIGH severity

CVE-2024-45596 — directus

HIGHFix: directus/directus@4aace0b

CVE-2024-45596 is a high-severity (CVSS 7.4) CWE-524 vulnerability in directus. A fix is available for directus — see the affected versions and patch details below.

Directus's session is cached for OpenID and OAuth2 if `redirect` is not used

Also known asGHSA-cff8-x7jv-4fm8
Published
Updated
Affected
4 pkgs
Patched
4 / 4
Exploits
None indexed
Exploitation data as of Oct 29, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2024-45596.

EPSS Exploitation Probability

via FIRST.org ↗
0.7%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs51th percentile — riskier than 51% of all scored CVEsHighest risk
0.12%0.50%0.87%1.25%0.8%0.7%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

4 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

12other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
directusnpm
26Kdownloads / week
@directus/apinpm
26Kdownloads / week

Description

Summary

Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string.

For example:

  • Project is configured with OpenID or OAuth2
  • Project is configured with cache enabled
  • User tries to login via SSO link, but without redirect query string
  • After successful login, credentials are cached
  • If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user

The SSO link is something like https://directus.example.com/auth/login/openid/callback, where openid is the name of the OpenID provider configured in Directus

Details

This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. For OpenID, this can be seen here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459 And for OAuth2 can be seen here https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428

PoC

  • Create a new Directus project
  • Set CACHE_ENABLED to true
  • Set CACHE_STORE to redis for reliable results (if using memory with multiple nodes, it may only happen sometimes, due to cache being different for different nodes)
  • Configure REDIS with redis string or redis host, port, user, etc.
  • Set AUTH_PROVIDERS to openid
  • Set PUBLIC_URL to the the main URL of your project . For example, PUBLIC_URL: http://localhost:8055
  • Configure AUTH_OPENID_CLIENT_ID, AUTH_OPENID_CLIENT_SECRET, AUTH_OPENID_ISSUER_URL with proper OpenID configurations
  • Be sure that on OpenID external app you have configured Redirect URI to http://localhost:8055/auth/login/openid/callback
  • Run Directus
  • Open the SSO link like http://localhost:8055/auth/login/openid/callback
  • Do the authentication on the OpenID external webpage
  • Verify that it you got redirected to a page with a JSON including access_token property
  • Be sure all anonymous mode windows are closed
  • Open an anonymous window and go to the SSO Link http://localhost:8055/auth/login/openid/callback and see you have the same credentials, even though you don't have any session because you are in anonymous mode

Impact

All projects using OpenID or OAuth 2, that does not include redirect query string on loggin in users.

Affected Packages

4 total 4 fixed
EcosystemPackageVulnerable rangeFix
📦npmdirectusall versions10.13.3npm install directus@10.13.3
📦npmdirectus≥ 11.0.0-rc.1&&< 11.1.011.1.0npm install directus@11.1.0
📦npm@directus/apiall versions21.0.1npm install @directus/api@21.0.1
📦npm@directus/api≥ 22.0.0&&< 22.2.022.2.0npm install @directus/api@22.2.0

Affected Products

1 product · 2 configurations
Application
directusmonospace
≥ 11.0.0 && < 11.1.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for directus, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update directus to 10.13.3 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2024-45596 is resolved across your whole dependency graph.

  3. Workarounds

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.

Frequently Asked Questions

### Summary Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include `redirect` query string. For example: - Project is configured with OpenID or OAuth2 - Project is configured with cache enabled - User tries to login via SSO link, but without `redirect` query string - After successful login, credentials are cached - If an unauthenticated user tries to login via SSO link, it will return the credentials of the other last user The SSO link is something like `https://directus.example.com/auth/login/openid/callback`,
O3 Security · Impact-Aware SCA

Is CVE-2024-45596 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2024-45596: directus — Fixed in 10.13.3