A missing security header in Directus SSO login pages allows unauthenticated attackers to hijack OAuth authorization flows and gain unauthorized access to user accounts.

This vulnerability involves a protection mechanism failure (CWE-693) and an origin validation error (CWE-346) occurring within the SSO login page. An unauthenticated attacker can exploit the lack of a Cross-Origin-Opener-Policy (COOP) header to manipulate the window object and redirect the OAuth flow to an attacker-controlled client.

The potential for unauthorized account access poses a severe threat to data confidentiality and integrity, as attackers may gain control over third-party authentication provider accounts linked to Directus. Given the CVSS score of 8.7, this is a high-severity risk that could lead to widespread credential compromise and unauthorized access to sensitive database content managed via the Directus dashboard.

Immediate Action: Update the Directus software to version 11.17.0 or later to implement the required Cross-Origin-Opener-Policy (COOP) HTTP response header.

Proactive Monitoring: Review authentication logs for unusual OAuth redirection patterns or unexpected user access origins that may indicate intercepted authorization flows.

Compensating Controls: Implement a strict Content Security Policy (CSP) and ensure that all web traffic is proxied through a modern security gateway or Web Application Firewall (WAF) capable of injecting missing security headers, such as COOP, until the patch is applied.

Public Exploit Available: No (exploit_available: unknown)

The severity of this vulnerability necessitates immediate attention to prevent account takeover incidents. Administrators should prioritize upgrading to version 11.17.0 across all instances to ensure the necessary header-based protections are enforced, thereby securing the OAuth integration against cross-origin manipulation.