Protection Mechanism Failure Affecting directus package, versions <11.17.0
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-DIRECTUS-15907600
- published5 Apr 2026
- disclosed4 Apr 2026
- creditUnknown
Introduced: 4 Apr 2026
NewCVE-2026-35408 (opens in a new tab)How to fix?
Upgrade directus to version 11.17.0 or higher.
Overview
directus is a Directus is a real-time API and App dashboard for managing SQL database content.
Affected versions of this package are vulnerable to Protection Mechanism Failure in the handling of Single Sign-On login pages due to the absence of the Cross-Origin-Opener-Policy HTTP response header. An attacker can gain unauthorized access to authentication provider accounts by opening the login page in a malicious cross-origin window and intercepting or redirecting the OAuth authorization flow.
Workaround
This vulnerability can be mitigated by configuring the reverse proxy or web server to add the HTTP response header: Cross-Origin-Opener-Policy: same-origin.