CVE-2026-105846

Published: Oct 6, 2026Modified: Oct 15, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: security-advisories@github.com (Secondary)

Description

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.

Affected (28)

Products: Payloadcms: Payload

Payloadcms

1 product

Payload

Configuration A

28 vulnerable

Vulnerable Software	Affected Versions
Payloadcms Payload	3.40.0 ≤ version < 3.88.0
Payloadcms Payload	Version 4.0.0 canary0
Payloadcms Payload	Version 4.0.0 canary10
Payloadcms Payload	Version 4.0.0 canary11
Payloadcms Payload	Version 4.0.0 canary12
Payloadcms Payload	Version 4.0.0 canary13
Payloadcms Payload	Version 4.0.0 canary14
Payloadcms Payload	Version 4.0.0 canary15
Payloadcms Payload	Version 4.0.0 canary16
Payloadcms Payload	Version 4.0.0 canary17
Payloadcms Payload	Version 4.0.0 canary18
Payloadcms Payload	Version 4.0.0 canary19
Payloadcms Payload	Version 4.0.0 canary1
Payloadcms Payload	Version 4.0.0 canary20
Payloadcms Payload	Version 4.0.0 canary21
Payloadcms Payload	Version 4.0.0 canary22
Payloadcms Payload	Version 4.0.0 canary23
Payloadcms Payload	Version 4.0.0 canary24
Payloadcms Payload	Version 4.0.0 canary25
Payloadcms Payload	Version 4.0.0 canary26
Payloadcms Payload	Version 4.0.0 canary2
Payloadcms Payload	Version 4.0.0 canary3
Payloadcms Payload	Version 4.0.0 canary4
Payloadcms Payload	Version 4.0.0 canary5
Payloadcms Payload	Version 4.0.0 canary6
Payloadcms Payload	Version 4.0.0 canary7
Payloadcms Payload	Version 4.0.0 canary8
Payloadcms Payload	Version 4.0.0 canary9

Related CWEs

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.

References (3)

https://github.com/payloadcms/payload/commit/a742140ab4fca3160f7f83e9e7d996552ffc3b5a

Source: security-advisories@github.com

Patch

https://github.com/payloadcms/payload/releases/tag/v3.88.0

Source: security-advisories@github.com

PatchRelease Notes

https://github.com/payloadcms/payload/security/advisories/GHSA-w84c-53h3-mc2g

Source: security-advisories@github.com

Vendor Advisory

Timeline

No history available yet.