Account Lockout Bypass in Payload CMS

Executive Summary

This vulnerability affects Payload CMS versions before 3.90.0 and canary versions before 4.0.0-canary.34. An unauthenticated attacker can exploit the account lockout mechanism by knowing an account's email or username to prevent that account from signing in.

Useful 0 Not Useful 0

Detection Guidance

Check Payload CMS versions before 3.90.0 or canary versions before 4.0.0-canary.34. Inspect logs for repeated failed login attempts targeting specific accounts.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected version of Payload CMS, an attacker could lock out legitimate users from their accounts, preventing access to the system. This could disrupt operations, especially if critical accounts are targeted.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an unauthenticated attacker to lock out user accounts by abusing the account lockout mechanism. This could lead to denial of service for legitimate users, potentially disrupting access to sensitive data. For GDPR, this may impact availability of personal data processing. For HIPAA, it could affect access to protected health information. However, specific compliance impacts depend on implementation and mitigation measures.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Payload CMS to version 3.90.0 or 4.0.0-canary.34 or later. Implement rate limiting on login endpoints to prevent abuse of the account lockout mechanism.

Useful 0 Not Useful 0