CVE-2026-22032: Directus SAML Auth Bypass Vulnerability

CVE-2026-22032 Overview

CVE-2026-22032 is an open redirect vulnerability affecting Directus, a real-time API and App dashboard for managing SQL database content. The vulnerability exists in the SAML authentication callback endpoint where the RelayState parameter, intended to preserve a user's original destination, lacks proper validation. While the login initiation flow validates redirect targets against allowed domains, this critical validation is not applied to the callback endpoint, enabling attackers to redirect users to arbitrary external URLs.

Critical Impact

Attackers can craft malicious SAML authentication requests that redirect users to attacker-controlled websites upon authentication completion, enabling phishing attacks, credential theft, and malware distribution.

Affected Products

• Directus versions prior to 11.14.0
• Directus SAML authentication module
• Directus API authentication endpoints

Discovery Timeline

• 2026-01-08 - CVE CVE-2026-22032 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-22032

Vulnerability Analysis

This open redirect vulnerability (CWE-601) allows unauthenticated attackers to abuse the Directus SAML authentication flow. The core issue stems from inconsistent validation of redirect targets between the login initiation and callback phases of SAML authentication. When a user completes SAML authentication, the application uses the RelayState parameter to redirect the user to their intended destination. However, the callback endpoint fails to verify whether this redirect target belongs to an allowed domain.

The vulnerability affects both success and error handling paths within the callback, meaning attackers can exploit the flaw regardless of whether authentication succeeds or fails. Since SAML authentication flows are typically initiated via links sent to users, this creates an ideal attack surface for phishing campaigns where victims believe they are interacting with legitimate authentication systems.

Root Cause

The root cause is insufficient validation of the RelayState parameter in the SAML callback endpoint. The isLoginRedirectAllowed utility function exists in the codebase to validate redirect targets against configured allowed domains, but this validation was not being applied during the callback phase. The login initiation properly calls this validation function, but the callback handler accepted arbitrary URLs without verification, creating an inconsistency in security controls.

Attack Vector

An attacker exploits this vulnerability by crafting a malicious SAML authentication request containing an attacker-controlled URL in the RelayState parameter. The attack flow proceeds as follows:

1. Attacker creates a link to the target Directus instance's SAML authentication endpoint
2. The RelayState parameter is set to an attacker-controlled phishing site
3. Victim clicks the link, believing it leads to legitimate Directus authentication
4. Upon completing SAML authentication, the victim is redirected to the malicious site
5. The attacker can harvest credentials, deliver malware, or conduct further attacks

The vulnerability requires no authentication to exploit and relies on user interaction (clicking the malicious link).

// Security patch from api/src/auth/drivers/saml.ts
 import type { AuthDriverOptions, User } from '../../types/index.js';
 import asyncHandler from '../../utils/async-handler.js';
 import { getConfigFromEnv } from '../../utils/get-config-from-env.js';
-import { LocalAuthDriver } from './local.js';
-import { isLoginRedirectAllowed } from '../../utils/is-login-redirect-allowed.js';
 import { getSchema } from '../../utils/get-schema.js';
+import { isLoginRedirectAllowed } from '../../utils/is-login-redirect-allowed.js';
+import { LocalAuthDriver } from './local.js';

// Register the samlify schema validator
samlify.setSchemaValidator(validator);

Source: GitHub Commit Update

Detection Methods for CVE-2026-22032

Indicators of Compromise

• Unusual SAML authentication requests with external URLs in RelayState parameters
• Authentication logs showing redirects to domains outside the organization's control
• User reports of being redirected to suspicious websites after Directus authentication
• Web server logs containing SAML callback requests with unfamiliar or malicious redirect targets

Detection Strategies

• Monitor SAML authentication endpoints for RelayState values pointing to external domains
• Implement web application firewall (WAF) rules to inspect and block suspicious redirect patterns
• Enable detailed logging on Directus authentication endpoints to capture full request parameters
• Deploy endpoint detection to identify users being redirected to known malicious domains after authentication

Monitoring Recommendations

• Configure alerts for SAML callback requests containing external URLs in redirect parameters
• Establish baseline of normal authentication redirect patterns to identify anomalous activity
• Integrate Directus authentication logs with SIEM for correlation with known phishing campaigns
• Monitor for spikes in authentication flows that terminate with external redirects

How to Mitigate CVE-2026-22032

Immediate Actions Required

• Upgrade Directus to version 11.14.0 or later immediately
• Review authentication logs for evidence of exploitation attempts
• Alert users to be cautious of unexpected redirects after SAML authentication
• Consider temporarily disabling SAML authentication if upgrade cannot be immediately applied

Patch Information

Directus version 11.14.0 contains the security patch that addresses this vulnerability. The fix ensures that the isLoginRedirectAllowed validation function is consistently applied to the SAML callback endpoint, preventing redirects to unauthorized external domains. Organizations should update to this version as soon as possible.

For technical details on the patch, see the GitHub Commit Update and the GitHub Security Advisory GHSA-3573.

Workarounds

• Restrict SAML authentication to trusted internal networks using firewall rules
• Implement a reverse proxy or WAF rule to validate RelayState parameters against allowed domains
• Configure Content Security Policy headers to restrict redirect targets
• Educate users to verify URLs after SAML authentication and report suspicious redirects

# Example nginx configuration to restrict SAML callback access
location /auth/login/saml/callback {
    # Allow only from trusted SAML IdP IP addresses
    allow 10.0.0.0/8;
    allow 192.168.1.0/24;
    deny all;
    
    proxy_pass http://directus_backend;
}