UpHeron
All vulnerabilities

Servers and applications

CVE-2025-53886

Tokens are not redacted in Flow logs

Severity
Medium 4.5
Published
14 Jul 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
11.9.0
Also known as
GHSA-f24x-rm6g-3w5v
Sources
NVD, Project advisories (GitHub)

Description

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 9.0.0 and prior to version 11.9.0, when using Directus Flows with the WebHook trigger all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. Malicious admins with access to the logs can hijack the user sessions within the token…

Affected software

SoftwareAffected versions
DirectusServers and applications · cpe:a:monospace:directus
  • From 9.0.0 before 11.9.0
DirectusServers and applications · github:directus/directus
  • From 9.0.0 before 11.9.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-53886
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-53886
  • GitHub Advisory Database https://github.com/advisories/GHSA-f24x-rm6g-3w5v
  • github.com https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v