p PatchFirst

CVE-2024-39896

CVE-2024-39896 · Directus allows SSO User Enumeration

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.

CVSS 7.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • directus

    Versions
    • >= 9.11, < 10.13.0: Affected

    No fix published

  • directus npm

    Affected ranges
    • ECOSYSTEM: ≥ 9.11, < 10.13.0

    Update to 10.13.0

Original sources

Check your server →