Cyber Resilience

CVE-2026-22032

Open Redirect in Monospace Directus ≤ 11.14.0

Published
08 January 2026
Modified
20 January 2026
Patch / advisory
CVSS Score v3.1 4.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS Score 0.0020 11th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-22032 is a medium-severity Open Redirect (CWE-601) vulnerability in Monospace Directus. Its CVSS base score is 4.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 11.14.0, an open redirect vulnerability exists in the Directus SAML authentication callback endpoint. During SAML authentication, the `RelayState` parameter is intended to preserve the…

more

user's original destination. However, while the login initiation flow validates redirect targets against allowed domains, this validation is not applied to the callback endpoint. This allows an attacker to craft a malicious authentication request that redirects users to an arbitrary external URL upon completion. The vulnerability is present in both the success and error handling paths of the callback. This vulnerability can be exploited without authentication. Version 11.14.0 contains a patch.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-28239Same product: Monospace Directus
CVE-2026-35411Same product: Monospace Directus
CVE-2026-35410Same product: Monospace Directus
CVE-2023-45820Same product: Monospace Directus
CVE-2024-6533Same product: Monospace Directus
CVE-2024-54151Same product: Monospace Directus
CVE-2024-45596Same product: Monospace Directus
CVE-2025-30352Same product: Monospace Directus
CVE-2026-35413Same product: Monospace Directus
CVE-2026-61836Same product: Monospace Directus

Affected Assets

monospace
directus
≤ 11.14.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)

Validate
Prove the fix (OWASP ASVS)
  • V3.7.2

Mitigating Controls (NIST 800-53 r5) AI

Input validation directly checks and rejects untrusted redirect targets before they are used in a response.

Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

mitigates

Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.

References