CVE-2025-538864.5MediumCWE-212

CVE-2025-53886: Directus doesn't redact tokens in Flow logs

directus

Affected: directus · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.5%probability of exploitation in the next 30 days

40th percentile

050100

Higher than 40% of scored CVEs

4.5MediumCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow. Version 11.9.0 fixes the issue.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

directus · directus>= 9.0.0, < 11.9.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Improper Removal of Sensitive Information Before Storage or Transfer · Information Disclosure
Vendor: directus
Published: July 2025
Band: Unlikely (under 1%), July 2025

CoverageNo articles yet

No CyberSIXT article names CVE-2025-53886 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.