VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Feb 12, 2026· Updated Feb 13, 2026

Directus Affected by User Enumeration via Password Reset Timing Attack

CVE-2026-26185

Description

Directus is a real-time API and App dashboard for managing SQL database content. Before 11.14.1, a timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration. This vulnerability is fixed in 11.14.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
directusnpm
< 11.14.111.14.1
@directus/apinpm
< 32.2.032.2.0

Affected products

2

Patches

1
e69aa7a5248c

Merge from fork (#26485)

https://github.com/directus/directusBrainslugJan 14, 2026via ghsa
commit
2 files changed · +9 −4
  • api/src/services/users.ts+4 −4 modified
    @@ -558,17 +558,17 @@ export class UsersService extends ItemsService {
 		const STALL_TIME = 500;
 		const timeStart = performance.now();
 
+		if (url && isUrlAllowed(url, env['PASSWORD_RESET_URL_ALLOW_LIST'] as string) === false) {
+			throw new InvalidPayloadError({ reason: `URL "${url}" can't be used to reset passwords` });
+		}
+
 		const user = await this.getUserByEmail(email);
 
 		if (user?.status !== 'active') {
 			await stall(STALL_TIME, timeStart);
 			throw new ForbiddenError();
 		}
 
-		if (url && isUrlAllowed(url, env['PASSWORD_RESET_URL_ALLOW_LIST'] as string) === false) {
-			throw new InvalidPayloadError({ reason: `URL "${url}" can't be used to reset passwords` });
-		}
-
 		const mailService = new MailService({
 			schema: this.schema,
 			knex: this.knex,
  • .changeset/olive-squids-tease.md+5 −0 added
    @@ -0,0 +1,5 @@
+---
+'@directus/api': patch
+---
+
+Fixed password reset timing

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.