GHSA-f24x-rm6g-3w5v

Directus tokens are not redacted in flow logs, exposing session credentials to all admin

Source: GitHub Advisory Database (reviewed) Moderate CVE-2025-53886

Packages

Ecosystem	Package	Affected	Fixed in
npm	directus	< 11.9.0	11.9.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Summary When using Directus Flows with the WebHook trigger, all incoming request details are logged including security sensitive data like access and refresh tokens in cookies. ### Impact Malicious admins with access to the logs can hijack the user sessions within the token expiration time of them triggering the Flow.

References

External links from the advisory. They lead to third-party sites.

https://github.com/directus/directus/security/advisories/GHSA-f24x-rm6g-3w5v web
https://nvd.nist.gov/vuln/detail/CVE-2025-53886 advisory
https://github.com/directus/directus/commit/859f664f56fb50401c407b095889cea38ff580e5 web
https://github.com/directus/directus package
https://github.com/directus/directus/releases/tag/v11.9.0 web