Read the docs
TI-2026-68475 Aliases CVE-2026-105804GHSA-q6mq-ch85-c8mm

Weak PBKDF2 iteration count in Payload password hashing

Priority LOW 24CWE-916Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower than recommended PBKDF2 work factor when hashing passwords (CWE-916). This reduces the computational effort needed to test recovered password hashes. An attacker with local access and high privileges can use this to test recovered hashes more quickly.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. Payload versions from 3.0.0 before 3.90.0 and canary versions from 4.0.0-canary.0 before 4.0.0-canary.34 use a lower-than-recommended PBKDF2 work factor for password hashing, reducing the computational effort required to test recovered password hashes. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0008 0th percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.90.0, 4.0.0-canary.34payload (npm): 3.90.0, 4.0.0-canary.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayload3.0.0 to before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.343.90.0, 4.0.0-canary.34Patch availableCNA
—payload (npm)3.0.0 to before 3.90.03.90.0Patch availableGHSA-q6mq-ch85-c8mm
—payload (npm)4.0.0-canary.0 to before 4.0.0-canary.344.0.0-canary.34Patch availableGHSA-q6mq-ch85-c8mm
  • payload Vendorpayloadcms Affected 3.0.0 to before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 3.90.0, 4.0.0-canary.34 Patch available CNA
  • payload (npm) Vendor— Affected 3.0.0 to before 3.90.0 Fixed in 3.90.0 Patch available GHSA-q6mq-ch85-c8mm
  • payload (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 4.0.0-canary.34 Patch available GHSA-q6mq-ch85-c8mm

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:*——payloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:*:*:* Versions — — ·payloadcms

Remediation

Upgrade to Payload 3.90.0 or 4.0.0-canary.34, the fixed versions for the 3.x and 4.0 canary lines.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.90.0, 4.0.0-canary.34
  • Fix · GHSA-q6mq-ch85-c8mm payload (npm) Fixed in 3.90.0 Advisory →
  • Fix · GHSA-q6mq-ch85-c8mm payload (npm) Fixed in 4.0.0-canary.34 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105804
  2. 2026-10-06 CISA SSVC decision points changed
  3. 2026-10-06 Priority changed: MEDIUM → LOW
  4. 2026-10-06 Alias added: GHSA-q6mq-ch85-c8mm
  5. 2026-10-06 Fix available: npm/[email protected], npm/[email protected] · GHSA-q6mq-ch85-c8mm
  6. 2026-10-06 CVSS score added · GHSA-q6mq-ch85-c8mm
  7. 2026-10-06 Weakness changed · GHSA-q6mq-ch85-c8mm
  8. 2026-10-06 4 new references · GHSA-q6mq-ch85-c8mm

References

Other 4

  • TI-2026-10166 PayloadCMS 3.84.1 - Authenticated account lockout bypass through default unlock access CVSS 4.0MEDIUM 5.3
  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-68480 SQL injection in Payload SQLite and Postgres adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68479 Prototype pollution in Payload Import Export plugin CVSS 4.0CRITICAL 9.3
See all 43 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences