{"id":"CVE-2026-35408","aliases":["GHSA-8m32-p958-jg99"],"url":"https://o3.security/vulnerability/CVE-2026-35408","summary":"Directus is Missing Cross-Origin Opener Policy","details":"## Summary\n\nDirectus's Single Sign-On (SSO) login pages lacked a `Cross-Origin-Opener-Policy` (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the `window` object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord).\n\n## Impact\n\nA successful attack allows the attacker to obtain an OAuth access token for the victim's third-party identity provider account. Depending on the scopes authorized, this can lead to:\n- Unauthorized access to the victim's linked identity provider account\n- Account takeover of the Directus instance if the attacker can authenticate using the stolen credentials or provider session\n\n## Patches\n\nThis issue has been addressed by adding the `Cross-Origin-Opener-Policy: same-origin` HTTP response header to SSO-related endpoints. This header instructs the browser to place the page in its own browsing context group, severing any reference the opener window may hold.\n\n## Workarounds\n\nUsers who are unable to upgrade immediately can mitigate this vulnerability by configuring their reverse proxy or web server to add the following HTTP response header to all Directus responses: `Cross-Origin-Opener-Policy: same-origin`","published":"2026-04-06T21:30:22.824Z","modified":"2026-08-12T03:51:45.510508376Z","cvss":{"score":8.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N"},"epss":{"score":0.00169,"percentile":0.06665,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"directus","fixedVersion":"11.17.0"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35408.json"},{"type":"ADVISORY","url":"https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35408"},{"type":"PACKAGE","url":"https://github.com/directus/directus"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:45.510508376Z"}}