All vulnerabilities
CVE-2026-105846GHSA-w84c-53h3-mc2g

Payload: Untrusted redirect URL parameter exploit

payloadcms payloadnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in3.88.0Also 4.0.0-canary.27GitHub
Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

  • 3.88.0payload, npmGitHubnpm install payload@3.88.0
  • 4.0.0-canary.27payload, npmGitHubnpm install payload@4.0.0-canary.27
  • 3.88.0@payloadcms/next, npmGitHubnpm install @payloadcms/next@3.88.0
  • 4.0.0-canary.27@payloadcms/next, npmGitHubnpm install @payloadcms/next@4.0.0-canary.27

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Under certain conditions, an attacker can craft a redirect link that sends a guest user to an untrusted destination after authenticating.

Patches

Users should upgrade Payload packages to >= 3.88.0 or >= 4.0.0-canary.27.

Workarounds

Upgrading is recommended. Until then, remove user-controlled redirect values from authentication flows or restrict them to known local paths.

Text from GitHub Advisory Database

Affected versions 12

  • payload, npm>= 3.40.0, < 3.88.0GitHub
  • payload, npm>= 4.0.0-canary.0, < 4.0.0-canary.27GitHub
  • @payloadcms/next, npm>= 3.31.0, < 3.88.0GitHub
  • @payloadcms/next, npm>= 4.0.0-canary.0, < 4.0.0-canary.27GitHub
  • payloadaffected: >= 3.40.0, < 3.88.0CVE List
  • payloadaffected: >= 4.0.0-canary.0, < 4.0.0-canary.27CVE List
  • nextaffected: >= 3.31.0, < 3.88.0CVE List
  • nextaffected: >= 4.0.0-canary.0, < 4.0.0-canary.27CVE List
  • payload, npmfrom 3.40.0, fixed in 3.88.0OSV
  • payload, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.27OSV
  • @payloadcms/next, npmfrom 3.31.0, fixed in 3.88.0OSV
  • @payloadcms/next, npmfrom 4.0.0-canary.0, fixed in 4.0.0-canary.27OSV

References 4