Directus versions prior to 11.14.1 contain a timing-based flaw in the password reset endpoint. When an invalid reset_url parameter is sent, the server’s response time differs by about 500 milliseconds depending on whether the supplied email address or username exists. This measurable delay allows an attacker to determine the existence of user accounts, constituting a user enumeration vulnerability. The flaw is categorized as CWE‑203, Information Exposure Through Timing Channels.

All deployments of Directus older than version 11.14.1, accessed via the Directus API or the Directus web application, are affected.

The CVSS score of 5.3 indicates a moderate severity for confidentiality. The EPSS score is less than 1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in CISA KEV. An attacker can exploit the flaw remotely by submitting crafted password reset requests to the publicly exposed HTTP endpoint, requiring only knowledge of plausible email addresses or usernames to test.