Open Redirect Flaw in Directus SAML Authentication by Directus

CVE-2026-22032

What is CVE-2026-22032?

Directus, a real-time API and App dashboard for managing SQL database content, is affected by an open redirect vulnerability in its SAML authentication callback endpoint. This issue exists in versions prior to 11.14.0, allowing attackers to manipulate the RelayState parameter to redirect users to arbitrary external URLs after authentication. Notably, while redirect targets are usually validated during login initiation, this validation does not extend to the callback endpoint itself. This vulnerability is exploitable without requiring user authentication, placing users at risk during both successful and erroneous authentication flows. The issue has been addressed in version 11.14.0 with an appropriate patch.

References