{"action":"Upgrade @directus/api to 21.0.1 or later.","affected":[{"fixed":"21.0.1","introduced":"0"},{"fixed":"22.2.0","introduced":"22.0.0"}],"component":"@directus/api","cve_ids":["CVE-2024-45596"],"ecosystem":"npm","epss":0.00655,"exploited":false,"fixed_versions":["21.0.1","22.2.0"],"ghsa_id":"GHSA-cff8-x7jv-4fm8","id":"tcs_01M5KFJH15S3YSFN3ARRHVRGZ0","modified_at":"2025-11-17T21:35:30Z","published_at":"2024-09-10T19:43:00Z","references":["https://osv.dev/vulnerability/GHSA-cff8-x7jv-4fm8","https://github.com/directus/directus/security/advisories/GHSA-cff8-x7jv-4fm8","https://nvd.nist.gov/vuln/detail/CVE-2024-45596","https://github.com/directus/directus/commit/4aace0bbe57232e38cd6a287ee475293e46dc91b","https://github.com/directus/directus/commit/769fa22797bff5a9231599883b391e013f122e52","https://github.com/directus/directus","https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L422-L428","https://github.com/directus/directus/blob/main/api/src/auth/drivers/openid.ts#L453-L459"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-cff8-x7jv-4fm8#npm/@directus/api","url":"https://osv.dev/vulnerability/GHSA-cff8-x7jv-4fm8"}],"summary":"Session is cached for OpenID and OAuth2 if `redirect` is not used"}