| Package | Affected versions | Patched versions |
|---|---|---|
| directus | < 11.15.0 | 11.15.0 |
| @directus/api | < 32.2.0 | 32.2.0 |
| directus | < 11.14.1 | 11.14.1 |
A timing-based user enumeration vulnerability exists in the password reset functionality. When an invalid reset_url parameter is provided, the response time differs by approximately 500ms between existing and non-existing users, enabling reliable user enumeration.
The password reset endpoint implements a timing protection mechanism to prevent user enumeration; however, URL validation executes before the timing protection is applied. This allows an attacker to distinguish between valid and invalid user accounts based on response timing differences.
This vulnerability violates user privacy and may facilitate targeted phishing attacks by allowing attackers to confirm the existence of user accounts.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free