GitHub Advisoryadvisory · npm

GHSA-w84c-53h3-mc2g Payload: Untrusted redirect URL parameter exploit

MEDIUM Published 2026-10-06 Modified 2026-10-06 Official page ↗
Aliases
CVE-2026-105846
Ecosystem
npm
Packages
payload, @payloadcms/next
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2026-10-06

Affected packages

• npm payload: >= 3.40.0, < 3.88.0 → fixed in 3.88.0 • npm payload: >= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27 • npm @payloadcms/next: >= 3.31.0, < 3.88.0 → fixed in 3.88.0 • npm @payloadcms/next: >= 4.0.0-canary.0, < 4.0.0-canary.27 → fixed in 4.0.0-canary.27

Description

Impact Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating. Patches Users should upgrade Payload packages to `>= 3.88.0` or `>= 4.0.0-canary.27`. Workarounds Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.

Related

Alias · CVE (1)

  • CVE-2026-105846 Payload is a free and open source headless content management system. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References