What is GHSA-q75c-4gmv-mg9x?

GHSA-q75c-4gmv-mg9x is a security advisory published by GitHub Security Advisories with Medium severity. Directus: Open Redirect in Admin 2FA Setup Page

Which CVE IDs does GHSA-q75c-4gmv-mg9x cover?

GHSA-q75c-4gmv-mg9x covers the following CVE IDs: CVE-2026-35411. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q75c-4gmv-mg9x?

GHSA-q75c-4gmv-mg9x has a CVSS v3 base score of 4.3, published by GitHub Security Advisories.

Which products are affected by GHSA-q75c-4gmv-mg9x?

GHSA-q75c-4gmv-mg9x affects 1 product, including: npm/directus:\u003c 11.16.1.

GHSA-q75c-4gmv-mg9xMediumCVSS 4.3

Directus: Open Redirect in Admin 2FA Setup Page

Vendor

GitHub Security Advisories

Published

April 4, 2026

Last Modified

April 7, 2026

🔗 CVE IDs covered (1)

CVE-2026-35411 →

📋 Description

Summary

Directus is vulnerable to an Open Redirect via the redirect query parameter on the /admin/tfa-setup page. When an administrator who has not yet configured Two-Factor Authentication (2FA) visits a crafted URL, they are presented with the legitimate Directus 2FA setup page. After completing the setup process, the application redirects the user to the attacker-controlled URL specified in the redirect parameter without any validation.

This vulnerability could be used in phishing attacks targeting Directus administrators, as the initial interaction occurs on a trusted domain.

Credits

Discovered by Neo by ProjectDiscovery (https://neo.projectdiscovery.io/)

🎯 Affected products1

npm/directus:< 11.16.1

🔗 References (3)

https://github.com/directus/directus/security/advisories/GHSA-q75c-4gmv-mg9x
https://nvd.nist.gov/vuln/detail/CVE-2026-35411
https://github.com/advisories/GHSA-q75c-4gmv-mg9x