CVE-2025-53886 - CVE House

Back to Database

Status published Medium CVE-2025-53886

Directus doesn't redact tokens in Flow logs

4.5 CVSS

Vulnerability Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53886

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from directus

View All →

Directus Vulnerable to Information Leakage in Existing Collections

Directus's conceal fields are searchable if read permissions enabled

Directus Vulnerable to Stored Cross-site Scripting

Directus has Improper Permission Handling on Deleted Fields

Directus allows unauthenticated file upload and file modification due to lacking input sanitization

Affected Vendor

directus

View all reports →

Affected Software

directus

Vulnerable Versions:

>= 9.0.0, < 11.9.0

Timeline

Official Publish: July 14th, 2025

Last Modified: July 15th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-200 CWE-212 CWE-532

MITRE ATT&CK TTPs

T1213 Data from Information Repositories

T1005 Data from Local System

T1552 Unsecured Credentials

Credential Access

T1041 Exfiltration Over C2 Channel

T1555 Credentials from Password Stores

Credential Access

T1078 Valid Accounts

T1562 Impair Defenses

Defense Evasion