Directus is a real‑time API and application dashboard used to manage SQL database content. A vulnerability exists in versions prior to 11.16.1 where the /admin/tfa-setup page accepts a redirect query parameter without validation. When an administrator who has not yet set up Two‑Factor Authentication visits a crafted URL, the site leads them through the legitimate 2FA setup flow and then redirects them to the attacker‑controlled URL. Although the flaw does not provide direct code execution or system compromise, it can be exploited to deliver phishing content or credential‑harvesting pages that appear to come from a trusted Directus domain.

All Directus installations running a version earlier than 11.16.1 are affected whenever Two‑Factor Authentication has not yet been configured for the administrator’s account. The vulnerability is confined to the admin/tfa-setup route and is independent of underlying infrastructure such as the operating system or database server.

The CVSS score of 4.3 indicates low severity, but the exploitability is high because an attacker only needs to generate a malicious URL and supply it to an administrator. The attack vector is remote over standard HTTP or HTTPS, and no local access or additional privileges are required. With no EPSS score available and the issue not listed in CISA’s KEV catalog, the opportunity for exploitation is still present due to the ease of crafting the redirect and the potential for credential theft from users who follow the forged link.