Directus versions prior to 10.13.3, between 11.0.0-rc.1 and before 11.1.0, prior to 21.0.1, and between 22.0.0 and before 22.2.0 have a vulnerability where unauthenticated users can access cached credentials of the last authenticated user via OpenID or OAuth2 if the login URL does not include a redirect query string. This occurs due to caching behavior on the authentication callback endpoint. The vulnerability allows exposure of access tokens to unauthenticated users under specific conditions.