Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M
CVE-2026-105863Payload authentication token field handling issue
Critical 9.2
In plain English
A critical-severity authentication bypass by spoofing in payload from payloadcms. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 32% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | payload | 3.90.0 | GHSA-66wr-7vmr-p5jq |
| npm | payload | 4.0.0-canary.34 | GHSA-66wr-7vmr-p5jq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| payloadcms | payload | >= 3.0.0, < 3.90.0>= 4.0.0-canary.0, < 4.0.0-canary.34 |
Weakness: CWE-290, CWE-915 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N