A vulnerability identified as problematic has been detected in Directus up to 11.16.0. This affects an unknown function of the file /admin/tfa-setup. This manipulation of the argument redirect causes open redirect.
This vulnerability appears as CVE-2026-35411. The attack may be initiated remotely. There is no available exploit.
You should upgrade the affected component.
