v12.0.19

Security

• #413 5b79c1f - security: Fixed a security issue (CVE-2026-35408) where responses were sent without a Cross-Origin-Opener-Policy header, so a (GHSA-8m32-p958-jg99) cross-origin page that opened the login page could keep a reference to its window and tamper with the SSO flow. The header is now set to same-origin by default and can be changed with CROSS_ORIGIN_OPENER_POLICY (same-origin-allow-popups or unsafe-none).
• #400 9ba2f5e - security: condition operation errors now only contain the path and type of each failed rule, so webhook flows returning (GHSA-fm3h-p9wm-h74h) the last operation data no longer leak $env, $accountability or other flow data (GHSA-fm3h-p9wm-h74h)
• #411 e0655b1 - security: Harden the login redirect validator against backslash and port bypasses (GHSA-f42p-ffpq-jh5c)

@wbce-d9/api 12.5.11

Patch Changes

• #413
  5b79c1f - security: Fixed a
  security issue (CVE-2026-35408) where responses were sent without a Cross-Origin-Opener-Policy header, so a
  (GHSA-8m32-p958-jg99) cross-origin page that opened the login page could keep a reference to its window and tamper
  with the SSO flow. The header is now set to same-origin by default and can be changed with
  CROSS_ORIGIN_OPENER_POLICY (same-origin-allow-popups or unsafe-none).

• #400
  9ba2f5e - security: condition
  operation errors now only contain the path and type of each failed rule, so webhook flows returning
  (GHSA-fm3h-p9wm-h74h) the last operation data no longer leak $env, $accountability or other flow data
  (GHSA-fm3h-p9wm-h74h)

• #411
  e0655b1 - security: Harden the
  login redirect validator against backslash and port bypasses (GHSA-f42p-ffpq-jh5c)

Dependency updates only: @wbce-d9/directus9@12.0.19