CVE-2026-105863
Received Received - Intake

Authentication Token Manipulation in Payload CMS

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: GitHub, Inc.

Description
Payload is a free and open source headless content management system. In versions after 3.0.0 and before 3.90.0, a custom field option that maps a field to a reserved authentication claim name can place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-105863
EUVD
EUVD-2026-93509

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
payloadcms payload >= 3.0.0, < 3.90.0
payloadcms payload >= 4.0.0-canary.0, < 4.0.0-canary.34

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CWE-915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Payload CMS versions after 3.0.0 and before 3.90.0 have a flaw where a custom field option can map a field to a reserved authentication claim name. This allows unintended values to be included in the authentication token issued during login, potentially compromising user sessions.

Impact Analysis

An attacker could exploit this to inject malicious values into authentication tokens, leading to unauthorized access to user accounts or elevated privileges. This could result in data breaches, account takeovers, or other security incidents depending on the system's configuration.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection principles or HIPAA's security requirements. Organizations using affected versions may face compliance violations, legal penalties, or reputational damage.

Mitigation Strategies

Upgrade Payload CMS to version 3.90.0 or later to address the vulnerability. Review custom field configurations to ensure no reserved authentication claim names are mapped to unintended values.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105863. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart