Open Redirect Vulnerability in Payload CMS

Executive Summary

Payload CMS versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27 have an open redirect vulnerability. An attacker can craft a URL parameter that redirects a guest user to an untrusted destination after they complete the authentication process.

Useful 0 Not Useful 0

Detection Guidance

Check Payload CMS version with: npm list @payloadcms/next or npm list payload. If version is between 3.40.0 and 3.88.0 or canary before 4.0.0-canary.27, it is vulnerable. Inspect network traffic for unusual redirect URLs after authentication flows.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to trick users into visiting malicious websites after login, potentially leading to phishing attacks, credential theft, or malware infections. Users may unknowingly expose sensitive data or system access.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to redirect users to untrusted destinations after authentication, which could lead to phishing attacks or unauthorized data exposure. This may violate GDPR's requirement for secure user authentication and data protection, and HIPAA's safeguards for protecting sensitive health information during access.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Payload CMS to version 3.88.0 or 4.0.0-canary.27 or later immediately. Review and restrict redirect URL parameters in authentication flows. Monitor for suspicious redirects or unauthorized access attempts.

Useful 0 Not Useful 0