Directus Lacks Session Tokens Invalidation

Description

Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry time which is set to 1 day by default. Making it effectively a long lived unrevokable stateless token instead of the stateful session token it was meant to be. This vulnerability is fixed in 10.11.0.

Scores

EPSS (exploitation in 30 days)

0.45% · top 61% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.4.

Weakness

• CWE-613: Insufficient Session Expiration (opens in a new tab)All about CWE-613 and its CVEs

Affected products

• directus · directus

  • affected >= 10.10.0, < 10.11.0

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• npmdirectusGHSA-g65h-35f3-x2w3 (opens in a new tab)

References (2)

• https://github.com/directus/directus/security/advisories/GHSA-g65h-35f3-x2w3 (opens in a new tab)x_refsource_CONFIRMx_transferred
• https://github.com/directus/directus/commit/a6172f8a6a0f31a6bf4305a090de172ebfb63bcf (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-g65h-35f3-x2w3 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2024-34709](https://trackcve.app/badge/CVE-2024-34709.svg)](https://trackcve.app/cve/CVE-2024-34709)

Record last updated 2 Aug 2024, 02:59 UTC.