CVE-2026-35408 is a missing Cross-Origin-Opener-Policy header on Directus single sign-on login pages, scored 8.7 (High) in the CVE record. A hostile page could redirect the OAuth flow. Directus fixed it in 11.17.0, and a reverse proxy header works as a workaround.
What's affected
- Product: Directus (npm package
directus) - Affected versions: before 11.17.0
- Fixed version: 11.17.0
- Affected feature: the Single Sign-On (SSO) login pages and endpoints
The GitHub advisory describes an attacker-controlled page that opens the Directus login page and keeps a reference to it. The record does not say the flaw is exploited in the wild, and the CVE is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
Check the Directus version you run.
npm ls directus
For container deployments, look at the image tag in use:
docker image ls | grep -i directus
If you use SSO providers such as Google or Discord and the version is older than 11.17.0, you are in scope. You can also test whether your deployment already sends the header by requesting your login URL and reading the response headers:
curl -sI https://your-directus.example.com/ | grep -i cross-origin-opener-policy
An empty result means the header is not being sent for that path. The advisory applies the fix to the SSO related endpoints.
What to do now
- Upgrade Directus to 11.17.0 or later.
- If you cannot upgrade now, add the response header Cross-Origin-Opener-Policy with the value same-origin to all Directus responses at your reverse proxy or web server. This is the advisory workaround.
- Review which identity providers are linked to your Directus users and whether any recent grants look odd.
- Test the login flow after the change to make sure SSO still works for your users.
Why it matters
The Cross-Origin-Opener-Policy header tells a browser to put a page in its own browsing context group. Without it, a window that opened the page keeps a handle on it and can change what it does. The advisory explains that this lets an attacker redirect the OAuth authorization to a client the attacker controls, so the victim grants access to their provider account without noticing.
The record files this under CWE-346, origin validation error, and CWE-693, protection mechanism failure. It is a good example of a flaw that is not a coding bug in the usual sense. It is a missing browser defence, and the fix is one header.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Can I fix this without upgrading?
The advisory says yes for a time. Add the header Cross-Origin-Opener-Policy: same-origin to all Directus responses at your reverse proxy or web server.
Is this exploited in the wild?
The record does not say so, and the CVE is not in the CISA catalog.
Sources
Last reviewed: 19 October 2026.
