Open Source Headless CMS Vulnerability in Payload by PayloadCMS
CVE-2026-105846

6.1MEDIUM

Key Information:

Vendor

Payloadcms

Status
Payload
Next
Vendor
CVE Published:
6 October 2026

What is CVE-2026-105846?

In certain versions of Payload, an attacker can exploit a vulnerability related to redirect URLs. A crafted URL parameter can mislead a guest user to untrusted destinations post-authentication. This issue has been addressed in subsequent versions, making it crucial for users to update to versions 3.88.0 or later.

Affected Version(s)

next >= 3.31.0, < 3.88.0 < 3.31.0, 3.88.0

next >= 4.0.0-canary.0, < 4.0.0-canary.27 < 4.0.0-canary.0, 4.0.0-canary.27

payload >= 3.40.0, < 3.88.0 < 3.40.0, 3.88.0

References

https://github.com/payloadcms/payload/security/advisories...
x_refsource_CONFIRM
https://github.com/payloadcms/payload/commit/a742140ab4fc...
x_refsource_MISC
https://github.com/payloadcms/payload/releases/tag/v3.88.0
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.