{"cve":"CVE-2026-35408","nvd":{"published":"2026-04-06T22:16:21.557","modified":"2026-07-24T21:10:00.143","status":"Analyzed","description":"Directus is a real-time API and App dashboard for managing SQL database content. Prior to 11.17.0, Directus's Single Sign-On (SSO) login pages lacked a Cross-Origin-Opener-Policy (COOP) HTTP response header. Without this header, a malicious cross-origin window that opens the Directus login page retains the ability to access and manipulate the window object of that page. An attacker can exploit this to intercept and redirect the OAuth authorization flow to an attacker-controlled OAuth client, causing the victim to unknowingly grant access to their authentication provider account (e.g. Google, Discord). This vulnerability is fixed in 11.17.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","score":9.3},"cwes":["CWE-346","CWE-693"],"references":["https://github.com/directus/directus/security/advisories/GHSA-8m32-p958-jg99"],"products":["monospace:directus"],"source":"nvd","synced_at":"2026-10-19T22:28:59.047572785+00:00"},"epss":{"cve":"CVE-2026-35408","score":0.00169,"percentile":0.06293,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-8m32-p958-jg99","url":"https://osv.dev/vulnerability/GHSA-8m32-p958-jg99","summary":"Directus: Missing Cross-Origin Opener Policy","modified":"2026-04-07T14:35:36.193204Z","packages":[{"ecosystem":"npm","name":"directus","purl":"pkg:npm/directus","ranges":["<11.17.0"],"fixed":["11.17.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}