CVE-2026-126539

Directus versions before 12.1.0 are vulnerable to an authorization bypass flaw on public-mode WebSocket connections. The root cause is that sending a failed authentication message with an invalid token causes handleAuthRequest to set accountability to null , allowing unauthenticated attackers to ...