CVE-2026-105846: Payload open redirect in authentication flow

CVE-2026-105846 · Severity: medium · CVSS 6.1 · Published 2026-10-06

Payload is a headless CMS framework that manages content and authentication. An attacker can craft a malicious link containing an untrusted redirect URL that, when clicked by a guest user during authentication, sends them to an external website after login. This enables phishing attacks or redirection to malicious sites without user awareness.

Technologies: @payloadcms/next (npm), payload (npm), Payload CMS Payload. Vendors: npm, Payload CMS.

Quick answers

Is CVE-2026-105846 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-105846 being exploited in the wild.
How severe is CVE-2026-105846?
Medium severity, with a CVSS score of 6.1, published 6 October 2026.
Which products and versions are affected?
@payloadcms/next (npm) SEMVER:introduced=3.31.0,fixed=3.88.0; payload (npm) SEMVER:introduced=3.40.0,fixed=3.88.0; Payload CMS @Payloadcms/Next >= 3.31.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27; Payload CMS Payload >= 3.40.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27.
Is there a fix for CVE-2026-105846?
Yes. @payloadcms/next (npm): upgrade to 3.88.0 or later; payload (npm): upgrade to 3.88.0 or later. Until then: Remove user-controlled redirect values from authentication flows or restrict them to known local paths only. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-105846 attacked?
It is attacked over the network.
Am I affected by CVE-2026-105846?
Check whether you run @payloadcms/next (npm), payload (npm), Payload CMS @Payloadcms/Next or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @payloadcms/next (npm): upgrade to 3.88.0 or later
    npm install @payloadcms/next@3.88.0
  • payload (npm): upgrade to 3.88.0 or later
    npm install payload@3.88.0

Remove user-controlled redirect values from authentication flows or restrict them to known local paths only.

Technical details

An open redirect vulnerability (CWE-601) exists in Payload's authentication flow where user-controlled redirect URL parameters are not properly validated. An unauthenticated attacker can supply a malicious redirect URL that gets followed after a user authenticates, requiring user interaction to click the crafted link. This allows attackers to redirect authenticated users to untrusted destinations for credential harvesting or phishing.

Affected products

  • Payload CMS payload >= 3.40.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27
  • Payload CMS @payloadcms/next >= 3.31.0, < 3.88.0; >= 4.0.0-canary.0, < 4.0.0-canary.27

Identifiers

  • CVE-2026-105846
  • GHSA-w84c-53h3-mc2g

Timeline

  • 2026-09-22: disclosed
  • 2026-10-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.