{"action":"Upgrade directus to 10.10.0 or later.","affected":[{"fixed":"10.10.0","introduced":"0"}],"component":"directus","cve_ids":["CVE-2024-28239"],"ecosystem":"npm","epss":0.00583,"exploited":false,"fixed_versions":["10.10.0"],"ghsa_id":"GHSA-fr3w-2p22-6w7p","id":"tcs_01M5KFP3H1M4QK8PJS8CTSQRKW","modified_at":"2026-09-10T03:50:10.481071098Z","published_at":"2024-03-12T20:50:48Z","references":["https://osv.dev/vulnerability/GHSA-fr3w-2p22-6w7p","https://github.com/directus/directus/security/advisories/GHSA-fr3w-2p22-6w7p","https://nvd.nist.gov/vuln/detail/CVE-2024-28239","https://github.com/directus/directus/commit/5477d7d61babd7ffc2f835d399bf79611b15b203","https://docs.directus.io/reference/authentication.html#login-using-sso-providers","https://github.com/directus/directus"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-fr3w-2p22-6w7p","url":"https://osv.dev/vulnerability/GHSA-fr3w-2p22-6w7p"}],"summary":"URL Redirection to Untrusted Site in OAuth2/OpenID in directus"}