CVE-2026-35408: Directus SSO Auth Bypass Vulnerability

CVE-2026-35408 Overview

CVE-2026-35408 is a high-severity vulnerability affecting Directus, a real-time API and App dashboard for managing SQL database content. Prior to version 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page.

An attacker can exploit this vulnerability to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g., Google, Discord).

Critical Impact
Attackers can hijack OAuth authentication flows, potentially gaining unauthorized access to victim accounts on identity providers like Google and Discord through cross-origin window manipulation.

Affected Products

Directus versions prior to 11.17.0
Directus SSO login pages using OAuth providers
Deployments utilizing identity providers (Google, Discord, etc.) for authentication

Discovery Timeline

April 6, 2026 - CVE-2026-35408 published to NVD
April 7, 2026 - Last updated in NVD database

Technical Details for CVE-2026-35408

Vulnerability Analysis

This vulnerability is classified as CWE-346 (Origin Validation Error), which occurs when the application fails to properly verify that an incoming request or communication originates from a trusted source. The absence of the Cross-Origin-Opener-Policy (COOP) header on SSO login pages creates a critical security gap in the OAuth authentication flow.

When a user initiates an OAuth login through Directus, the authentication flow typically opens in a new window or redirects the user to the identity provider. Without the COOP header set to same-origin or a similarly restrictive value, cross-origin windows maintain a reference to the window.opener object. This allows a malicious page that opened the Directus login window to retain access to and manipulate the window object.

The attack requires network access and involves some complexity in setting up the malicious infrastructure, but requires no authentication or special privileges to execute. The scope of impact extends beyond Directus itself to the victim's identity provider accounts.

Root Cause

The root cause of this vulnerability lies in the missing Cross-Origin-Opener-Policy HTTP response header on Directus SSO login pages. The COOP header is a security mechanism designed to prevent cross-origin windows from accessing each other's browsing contexts. When absent, browsers allow cross-origin window references to persist, enabling cross-origin window manipulation attacks.

Specifically, when a malicious website opens a Directus login page using window.open(), the returned reference maintains access to the opened window's properties and methods. This design flaw allows attackers to interfere with the OAuth authorization flow by modifying the window's location or intercepting sensitive authentication data.

Attack Vector

The attack leverages the network-accessible SSO login endpoints and exploits the OAuth authorization flow through cross-origin window manipulation:

An attacker hosts a malicious website and entices a victim to visit it
The malicious page uses window.open() to open the Directus SSO login page
Due to the missing COOP header, the attacker's page retains a reference to the opened window
As the victim proceeds with OAuth authentication, the attacker intercepts the flow
The attacker redirects the OAuth authorization to an attacker-controlled OAuth client
The victim unknowingly grants the attacker access to their identity provider account

This attack can compromise accounts on major identity providers such as Google and Discord, potentially leading to unauthorized access to sensitive data and services linked to those accounts. For technical details, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-35408

Indicators of Compromise

Unusual OAuth authorization requests originating from unexpected client applications
Authentication logs showing redirects to unfamiliar OAuth client IDs
Users reporting unexpected access grants to their identity provider accounts
Network traffic indicating cross-origin window interactions with SSO login pages

Detection Strategies

Review HTTP response headers on SSO login pages for missing COOP headers
Monitor OAuth provider dashboards for unauthorized client authorizations
Implement logging for OAuth flow redirects and client ID changes
Analyze web server access logs for patterns indicating cross-origin window attacks

Monitoring Recommendations

Enable detailed logging on Directus SSO authentication endpoints
Configure alerts for OAuth authorization requests to non-approved client IDs
Monitor identity provider audit logs for suspicious access grants
Implement Content Security Policy (CSP) reporting to detect unauthorized framing attempts

How to Mitigate CVE-2026-35408

Immediate Actions Required

Upgrade Directus to version 11.17.0 or later immediately
Review OAuth provider dashboards for any unauthorized application authorizations
Audit user accounts for signs of compromise following OAuth hijacking
Notify users to review their identity provider connected applications

Patch Information

Directus has addressed this vulnerability in version 11.17.0. The fix implements the Cross-Origin-Opener-Policy header on SSO login pages, preventing cross-origin windows from manipulating the authentication flow. Organizations should upgrade to the patched version as the primary remediation strategy. For complete details, see the GitHub Security Advisory.

Workarounds

Implement a reverse proxy or web application firewall to inject the COOP header on SSO endpoints
Configure server-level headers using web server configuration (nginx, Apache)
Restrict SSO authentication to trusted network segments where possible
Consider temporarily disabling SSO until the upgrade can be completed

bash

# Nginx configuration to add COOP header as interim mitigation
location /auth/login {
    add_header Cross-Origin-Opener-Policy "same-origin" always;
    # ... existing proxy configuration
}