Directus enables the use of SAML authentication where the RelayState parameter is meant to return users to their original destination after login. Prior to version 11.14.0 the callback endpoint for SAML does not enforce that RelayState points only to allowed domains. This omission allows an attacker to manipulate the parameter so that, after an authentication attempt, the user is redirected to any external URL. The flaw is a classic open‑redirect weakness (CWE‑601). Should a user click a malicious link in an email or on a website that points to the compromised Directus instance, they could be steered to phishing sites or other malicious content, undermining user trust and potentially enabling credential theft or session hijacking. The vulnerability can be exercised without needing to log in first; any recipient of a crafted authentication request can send a user to an arbitrary destination. The attacker’s capability is limited to redirecting a legitimate user but not to modifying data or gaining direct access to the Directus system.

The affected product is Directus, an open‑source database content management API and dashboard. Versions of Directus prior to 11.14.0 contain the flaw, and the issue is present in both the success and error paths of the SAML callback endpoint.

The CVSS score is 4.3, reflecting a moderate impact. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a crafted SAML authentication request that exploits the open redirect exactly when the callback is processed; an attacker does not need to authenticate to the Directus instance to trigger the flaw. While the risk is not high, the possibility of using the redirect in a phishing or social engineering attack warrants attention.