The vulnerability arises from the login redirect logic in Directus before version 11.16.1. The isLoginRedirectAllowed function fails to correctly detect malformed URLs as external. This allows attackers to bypass the redirect allow-list and send users to arbitrary external domains after authentication. The primary impact is that authenticated users can be redirected to malicious sites, enabling phishing and credential harvesting.

Affected systems are Directus installations running any version prior to 11.16.1. The vulnerability is present in the directus:directus product and was fixed in Directus 11.16.1. Users of earlier releases should evaluate their environment and prepare an upgrade.

Risk assessment: The CVSS score is 6.1, indicating moderate severity. EPSS is not provided, and the vulnerability is not listed in CISA KEV. The attack vector is likely remote and requires an attacker to supply a crafted redirect parameter during the OAuth2/SAML authentication flow. Because the exploit is straightforward once the login flow is accessed, the potential for malicious redirection is significant, especially in environments where users trust the application for authentication. Therefore, the risk is moderate but still warrants prompt remediation.