MEDIUM4.5
GHSA-f24x-rm6g-3w5v
Directus tokens are not redacted in flow logs, exposing session credentials to all admin
Quick fix
GHSA-f24x-rm6g-3w5v — directus: upgrade to the fixed version with the command below.
npm install directus@11.9.0Details
### Summary
When using Directus Flows with the WebHook trigger, all incoming request details are logged including security sensitive data like access and refresh tokens in cookies.
### Impact
Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow.
Are you affected?
Enter the version of the package you're using.
Affected packages
References
- https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2025-53886[ADVISORY]
- https://github.com/directus/directus/commit/859f664f56fb50401c407b095889cea38ff580e5[WEB]
- https://github.com/directus/directus[PACKAGE]
- https://github.com/directus/directus/releases/tag/v11.9.0[WEB]