Read the docs
TI-2026-68612 Aliases CVE-2026-105863GHSA-66wr-7vmr-p5jq

Payload authentication token field handling issue

Priority MEDIUM 48CWE-290Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass, Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-290 and CWE-915.

Summary

Payload, a free and open source headless content management system, is affected in versions from 3.0.0 before 3.90.0 and from 4.0.0-canary.0 before 4.0.0-canary.34. A custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. The issue is classified as CWE-290 (Authentication Bypass by Spoofing) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes). The CVSS 4.0 base score is 9.2, rated CRITICAL.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00549 46th percentileScored 2026-11-07
Fix Fixed payload (payloadcms): 3.90.0, 4.0.0-canary.34payload (npm): 3.90.0, 4.0.0-canary.34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
payloadcmspayload3.0.0 to before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.343.90.0, 4.0.0-canary.34Patch availableCNA
—payload (npm)3.0.0 to before 3.90.03.90.0Patch availableGHSA-66wr-7vmr-p5jq
—payload (npm)4.0.0-canary.0 to before 4.0.0-canary.344.0.0-canary.34Patch availableGHSA-66wr-7vmr-p5jq
  • payload Vendorpayloadcms Affected 3.0.0 to before 3.90.0; 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 3.90.0, 4.0.0-canary.34 Patch available CNA
  • payload (npm) Vendor— Affected 3.0.0 to before 3.90.0 Fixed in 3.90.0 Patch available GHSA-66wr-7vmr-p5jq
  • payload (npm) Vendor— Affected 4.0.0-canary.0 to before 4.0.0-canary.34 Fixed in 4.0.0-canary.34 Patch available GHSA-66wr-7vmr-p5jq

CPE configurations NVD · 35

CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:*3.0.0 to before 3.90.0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:*4.0.0 canary0Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:*4.0.0 canary1Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:*4.0.0 canary10Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:*4.0.0 canary11Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:*4.0.0 canary12Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:*4.0.0 canary13Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:*4.0.0 canary14Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:*4.0.0 canary15Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:*4.0.0 canary16Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:*:*:*:*:*:node.js:*:* Versions 3.0.0 to before 3.90.0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary0:*:*:*:node.js:*:* Versions 4.0.0 canary0 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary1:*:*:*:node.js:*:* Versions 4.0.0 canary1 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary10:*:*:*:node.js:*:* Versions 4.0.0 canary10 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary11:*:*:*:node.js:*:* Versions 4.0.0 canary11 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary12:*:*:*:node.js:*:* Versions 4.0.0 canary12 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary13:*:*:*:node.js:*:* Versions 4.0.0 canary13 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary14:*:*:*:node.js:*:* Versions 4.0.0 canary14 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary15:*:*:*:node.js:*:* Versions 4.0.0 canary15 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary16:*:*:*:node.js:*:* Versions 4.0.0 canary16 Vulnerable ·payloadcms
Show 25 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:*4.0.0 canary17Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:*4.0.0 canary18Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:*4.0.0 canary19Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:*4.0.0 canary2Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:*4.0.0 canary20Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:*4.0.0 canary21Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:*4.0.0 canary22Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:*4.0.0 canary23Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:*4.0.0 canary24Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:*4.0.0 canary25Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:*4.0.0 canary26Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:*4.0.0 canary27Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:*4.0.0 canary28Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:*4.0.0 canary29Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:*4.0.0 canary3Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:*4.0.0 canary30Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:*4.0.0 canary31Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:*4.0.0 canary32Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:*4.0.0 canary33Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:*4.0.0 canary4Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:*4.0.0 canary5Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:*4.0.0 canary6Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:*4.0.0 canary7Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:*4.0.0 canary8Vulnerablepayloadcms
cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:*4.0.0 canary9Vulnerablepayloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary17:*:*:*:node.js:*:* Versions 4.0.0 canary17 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary18:*:*:*:node.js:*:* Versions 4.0.0 canary18 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary19:*:*:*:node.js:*:* Versions 4.0.0 canary19 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary2:*:*:*:node.js:*:* Versions 4.0.0 canary2 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary20:*:*:*:node.js:*:* Versions 4.0.0 canary20 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary21:*:*:*:node.js:*:* Versions 4.0.0 canary21 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary22:*:*:*:node.js:*:* Versions 4.0.0 canary22 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary23:*:*:*:node.js:*:* Versions 4.0.0 canary23 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary24:*:*:*:node.js:*:* Versions 4.0.0 canary24 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary25:*:*:*:node.js:*:* Versions 4.0.0 canary25 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary26:*:*:*:node.js:*:* Versions 4.0.0 canary26 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary27:*:*:*:node.js:*:* Versions 4.0.0 canary27 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary28:*:*:*:node.js:*:* Versions 4.0.0 canary28 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary29:*:*:*:node.js:*:* Versions 4.0.0 canary29 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary3:*:*:*:node.js:*:* Versions 4.0.0 canary3 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary30:*:*:*:node.js:*:* Versions 4.0.0 canary30 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary31:*:*:*:node.js:*:* Versions 4.0.0 canary31 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary32:*:*:*:node.js:*:* Versions 4.0.0 canary32 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary33:*:*:*:node.js:*:* Versions 4.0.0 canary33 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary4:*:*:*:node.js:*:* Versions 4.0.0 canary4 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary5:*:*:*:node.js:*:* Versions 4.0.0 canary5 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary6:*:*:*:node.js:*:* Versions 4.0.0 canary6 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary7:*:*:*:node.js:*:* Versions 4.0.0 canary7 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary8:*:*:*:node.js:*:* Versions 4.0.0 canary8 Vulnerable ·payloadcms
  • cpe:2.3:a:payloadcms:payload:4.0.0:canary9:*:*:*:node.js:*:* Versions 4.0.0 canary9 Vulnerable ·payloadcms

Remediation

Upgrade to Payload 3.90.0 for the 3.x line, or to 4.0.0-canary.34 for the 4.0 canary line.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA payload (payloadcms) Fixed in 3.90.0, 4.0.0-canary.34
  • Fix · GHSA-66wr-7vmr-p5jq payload (npm) Fixed in 3.90.0 Advisory →
  • Fix · GHSA-66wr-7vmr-p5jq payload (npm) Fixed in 4.0.0-canary.34 Advisory →

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-105863
  2. 2026-10-07 Alias added: GHSA-66wr-7vmr-p5jq
  3. 2026-10-07 Fix available: npm/[email protected], npm/[email protected] · GHSA-66wr-7vmr-p5jq
  4. 2026-10-07 CVSS score added · GHSA-66wr-7vmr-p5jq
  5. 2026-10-07 Weakness changed · GHSA-66wr-7vmr-p5jq
  6. 2026-10-07 5 new references · GHSA-66wr-7vmr-p5jq
  7. 2026-10-09 CISA SSVC decision points changed
  8. 2026-10-15 CVSS score added · NVD

References

Patch 2

Advisory 2

Other 1

  • TI-2026-20653 Payload has an SQL Injection in JSON/RichText Queries on PostgreSQL/SQLite Adapters CVSS 3.1CRITICAL 9.8
  • TI-2026-68608 Payload CMS lets attackers update collection documents CVSS 3.1CRITICAL 9.8
  • TI-2026-68606 Remote code execution in Payload Form Builder plugin CVSS 3.1CRITICAL 10.0
  • TI-2026-26995 Payload has Unvalidated Input in Password Recovery Endpoints CVSS 3.1CRITICAL 9.1
  • TI-2026-68489 Field access control bypass in Payload duplicate operation CVSS 4.0CRITICAL 9.3
  • TI-2022-10819 An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0… CVSS 3.1CRITICAL 9.8
See all 34 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences